Windows Suspicious File Download Streams From File/Paste Hosting Domains With Script Extensions

Alert on Windows file stream hash creation involving downloads from paste/file-sharing domains targeting .bat/.cmd/.ps1 content indicators.

FreeReviewedSigma · Medium · v2

Product: windows
Category: create_stream_hash
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564.004NTFS File Attributes
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows events where a file stream is created and the destination domain matches common file-sharing or paste-hosting sites. It further narrows matches to streamed filenames containing .bat, .cmd, or .ps1 indicators, which can be abused to deliver executable scripts. The detection relies on Windows stream-hash telemetry fields for the destination domain and the target filename content markers.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange

Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)

Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)

Suspicious Run Key Referencing Alternate Data Stream Payload

macOS chflags Hidden Flag Set via chflags hidden parameter

Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream

Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Windows suspicious file download URLs using direct IP address with script/binary extensions

Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs

Windows Suspicious File Download Streams From File/Paste Hosting Domains With Script Extensions

Pivot detection · T1564.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-file-stream-downloads-from-file-sharing-domains-with-script-e-ae02ed70

title: Windows Suspicious File Download Streams From File/Paste Hosting Domains With Script Extensions
id: 99ab6905-8356-4888-b975-722660254ac3
related:
  - id: 8b48ad89-10d8-4382-a546-50588c410f0d
    type: similar
  - id: d635249d-86b5-4dad-a8c7-d7272b788586
    type: similar
  - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
    type: similar
  - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
    type: similar
  - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
    type: similar
  - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
    type: similar
  - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
    type: similar
  - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
    type: similar
  - id: b6e04788-29e1-4557-bb14-77f761848ab8
    type: similar
  - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
    type: similar
  - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
    type: similar
  - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
    type: derived
status: test
description: This rule flags Windows events where a file stream is created and the destination domain matches common file-sharing or paste-hosting sites. It further narrows matches to streamed filenames containing .bat, .cmd, or .ps1 indicators, which can be abused to deliver executable scripts. The detection relies on Windows stream-hash telemetry fields for the destination domain and the target filename content markers.
references:
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_unusual_extension.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-24
modified: 2026-03-29
tags:
  - attack.stealth
  - attack.s0139
  - attack.t1564.004
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection_domain:
    Contents|contains:
      - .githubusercontent.com
      - 0x0.st
      - anonfiles.com
      - bashupload.com
      - cdn.discordapp.com
      - chunk.io
      - ddns.net
      - dl.dropboxusercontent.com
      - ghostbin.co
      - github.com
      - glitch.me
      - gofile.io
      - hastebin.com
      - mediafire.com
      - mega.nz
      - onrender.com
      - pages.dev
      - paste.ee
      - pastebin.com
      - pastebin.pl
      - pastetext.net
      - pixeldrain.com
      - privatlab.com
      - privatlab.net
      - send.exploit.in
      - sendspace.com
      - storage.googleapis.com
      - storjshare.io
      - supabase.co
      - temp.sh
      - transfer.sh
      - trycloudflare.com
      - ufile.io
      - w3spaces.com
      - workers.dev
      - x0.at
  selection_extension:
    TargetFilename|contains:
      - .bat:Zone
      - .cmd:Zone
      - .ps1:Zone
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL