Detection rules › Sigma

Execute From Alternate Data Streams

Severity
medium
Author
frack113
Source
upstream

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1564.004 Hide Artifacts: NTFS File Attributes

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection_stream

CommandLine|contains: 'txt:'

Stage 2: 1 of selection_tools_type

CommandLine|contains: ' > '
CommandLine|contains: 'type '

Stage 3: 1 of selection_tools_makecab

CommandLine|contains: .cab
CommandLine|contains: 'makecab '

Stage 4: 1 of selection_tools_reg

CommandLine|contains: ' export '
CommandLine|contains: 'reg '

Stage 5: 1 of selection_tools_regedit

CommandLine|contains: ' /E '
CommandLine|contains: 'regedit '

Stage 6: 1 of selection_tools_esentutl

CommandLine|contains: ' /d '
CommandLine|contains: ' /o '
CommandLine|contains: ' /y '
CommandLine|contains: 'esentutl '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /E
  • /d corpus 2 (sigma 2)
  • /o corpus 2 (sigma 2)
  • /y corpus 2 (sigma 2)
  • > corpus 5 (sigma 5)
  • export corpus 2 (sigma 2)
  • .cab corpus 5 (sigma 5)
  • esentutl
  • makecab
  • reg corpus 3 (sigma 3)
  • regedit
  • txt:
  • type corpus 6 (sigma 6)