rules/windows/create_stream_hash/sysmon_ads_executable.yml

title: Executable in ADS
id: b69888d4-380c-45ce-9cf9-d9ce46e67821
status: test
description: Detects the creation of an ADS data stream that contains an executable (non-empty imphash)
author: Florian Roth, @0xrawsec
references:
  - https://twitter.com/0xrawsec/status/1002478725605273600?s=21
date: 2018/06/03
modified: 2021/12/08
logsource:
  product: windows
  category: create_stream_hash
  definition: 'Requirements: Sysmon config with Imphash logging activated'
detection:
  selection:
    Hashes|contains: 'IMPHASH='
  filter:
    Hashes|contains: 'IMPHASH=00000000000000000000000000000000'
  condition: selection and not filter
fields:
  - TargetFilename
  - Image
falsepositives:
  - Unknown
level: critical
tags:
  - attack.defense_evasion
  - attack.s0139
  - attack.t1564.004
Rule: ADS with executable 2018-06-03 02:08:39 +02:00			`title: Executable in ADS`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: b69888d4-380c-45ce-9cf9-d9ce46e67821`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Rule: ADS with executable 2018-06-03 02:08:39 +02:00			`description: Detects the creation of an ADS data stream that contains an executable (non-empty imphash)`
			`author: Florian Roth, @0xrawsec`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`references:`
			`- https://twitter.com/0xrawsec/status/1002478725605273600?s=21`
Rule: ADS with executable 2018-06-03 02:08:39 +02:00			`date: 2018/06/03`
fix: dysfunctional imphash rules 2021-12-08 11:26:17 +01:00			`modified: 2021/12/08`
Rule: ADS with executable 2018-06-03 02:08:39 +02:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`product: windows`
			`category: create_stream_hash`
			`definition: 'Requirements: Sysmon config with Imphash logging activated'`
Rule: ADS with executable 2018-06-03 02:08:39 +02:00			`detection:`
fix: dysfunctional imphash rules 2021-12-08 11:26:17 +01:00			`selection:`
			`Hashes\|contains: 'IMPHASH='`
			`filter:`
			`Hashes\|contains: 'IMPHASH=00000000000000000000000000000000'`
			`condition: selection and not filter`
Rule: ADS with executable 2018-06-03 02:08:39 +02:00			`fields:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- TargetFilename`
			`- Image`
Rule: ADS with executable 2018-06-03 02:08:39 +02:00			`falsepositives:`
fix: unknown --> Unknown 2022-03-16 13:43:54 +01:00			`- Unknown`
Rule: ADS with executable 2018-06-03 02:08:39 +02:00			`level: critical`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.defense_evasion`
			`- attack.s0139`
			`- attack.t1564.004`