win:sysmon 15
FileCreateStreamHash
This event logs when a named file stream is created, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 20
- Rules depending on it
- Splunk 6, Sigma 9
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
- T1027.006 HTML Smuggling
- T1027.012 LNK Icon Smuggling
- T1070.006 Timestomp
- T1137.001 Office Template Macros
- T1204.002 Malicious File
- T1546.008 Accessibility Features
- T1547.009 Shortcut Modification
- T1553.005 Mark-of-the-Web Bypass
- T1555.004 Windows Credential Manager
- T1555.005 Password Managers
- T1564.004 NTFS File Attributes
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation
- T1565.002 Transmitted Data Manipulation
- T1565.003 Runtime Data Manipulation
- T1574.001 DLL
- T1574.005 Executable Installer File Permissions Weakness
- T1574.008 Path Interception by Search Order Hijacking
- T1574.009 Path Interception by Unquoted Path
- T1574.010 Services File Permissions Weakness
Rules that depend on it
Splunk 6
Sigma 9
- Creation Of a Suspicious ADS File Outside a Browser Download by frack113
- Exports Registry Key To an Alternate Data Stream by Oddvar Moe, Sander Wiebing, oscd.community
- HackTool Named File Stream Created by Florian Roth (Nextron Systems)
- Hidden Executable In NTFS Alternate Data Stream by Florian Roth (Nextron Systems), @0xrawsec
- Potential Suspicious Winget Package Installation by Nasreddine Bencherchali (Nextron Systems)
- Potentially Suspicious File Download From ZIP TLD by Florian Roth (Nextron Systems)
- Suspicious File Download From File Sharing Websites - File Stream by Florian Roth (Nextron Systems)
- Unusual File Download From File Sharing Websites - File Stream by Florian Roth (Nextron Systems)
- Unusual File Download from Direct IP Address by Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)