Creation Of a Suspicious ADS File Outside a Browser Download

Event coverage

Stages and Predicates

or:
TargetFilename|contains: .bat
TargetFilename|contains: .cmd
TargetFilename|contains: .docx
TargetFilename|contains: .exe
TargetFilename|contains: .hta
TargetFilename|contains: .jse
TargetFilename|contains: .lnk
TargetFilename|contains: .pptx
TargetFilename|contains: .ps
TargetFilename|contains: .reg
TargetFilename|contains: .scr
TargetFilename|contains: .sct
TargetFilename|contains: .vb
TargetFilename|contains: .wsc
TargetFilename|contains: .wsf
TargetFilename|contains: .xlsx
Contents|startswith: '[ZoneTransfer]  ZoneId=3'
TargetFilename|endswith: ':Zone.Identifier'

or:
or:
Image|endswith: '\msedge.exe'
Image|endswith: '\msedgewebview2.exe'
or:
Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeCore\'
Image|startswith: 'C:\Program Files\Microsoft\EdgeCore\'
Image|endswith: '\SnippingTool\SnippingTool.exe'
Image|startswith: 'C:\Program Files\WindowsApps\Microsoft.ScreenSketch_'
TargetFilename|endswith: '.png:Zone.Identifier'
TargetFilename|contains: '\AppData\Local\Packages\Microsoft.ScreenSketch_'
TargetFilename|contains: '\TempState\Screenshot '
TargetFilename|startswith: 'C:\Users\'
Image|endswith: '\WindowsApps\MicrosoftEdge.exe'
Image|endswith: '\brave.exe'
Image|endswith: '\maxthon.exe'
Image|endswith: '\opera.exe'
Image|endswith: '\safari.exe'
Image|endswith: '\seamonkey.exe'
Image|endswith: '\vivaldi.exe'
Image|endswith: '\whale.exe'
Image: 'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe'
Image: 'C:\Program Files (x86)\Internet Explorer\iexplore.exe'
Image: 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
Image: 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'
Image: 'C:\Program Files\Google\Chrome\Application\chrome.exe'
Image: 'C:\Program Files\Internet Explorer\iexplore.exe'
Image: 'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
Image: 'C:\Program Files\Mozilla Firefox\firefox.exe'
Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeWebView\Application\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.