huntrule

Windows Suspicious File Download Streams From File/Paste Hosting Domains With Script Extensions

Alert on Windows file stream hash creation involving downloads from paste/file-sharing domains targeting .bat/.cmd/.ps1 content indicators.

FreeReviewedSigma · Medium · v2
Product
windows
Category
create_stream_hash
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows events where a file stream is created and the destination domain matches common file-sharing or paste-hosting sites. It further narrows matches to streamed filenames containing .bat, .cmd, or .ps1 indicators, which can be abused to deliver executable scripts. The detection relies on Windows stream-hash telemetry fields for the destination domain and the target filename content markers.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange
Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)
Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)
Suspicious Run Key Referencing Alternate Data Stream Payload
macOS chflags Hidden Flag Set via chflags hidden parameter
Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream
Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream
Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths
Windows suspicious file download URLs using direct IP address with script/binary extensions
Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs
Windows Suspicious File Download Streams From File/Paste Hosting Domains With Script Extensions
Pivot detection · T1564.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.