diff --git a/rules/windows/create_stream_hash/create_stream_hash_hacktool_download.yml b/rules/windows/create_stream_hash/create_stream_hash_hacktool_download.yml
new file mode 100644
index 000000000..c7322959e
--- /dev/null
+++ b/rules/windows/create_stream_hash/create_stream_hash_hacktool_download.yml
@@ -0,0 +1,157 @@
+title: Hacktool Download
+id: 35fda18e-8b57-409a-a13c-80dec8873346
+status: experimental
+description: Detects the creation of a file on disk that has an imphash of a well-known hack tool
+author: Florian Roth
+references:
+  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015
+date: 2022/08/24
+logsource:
+  product: windows
+  category: create_stream_hash
+  definition: 'Requirements: Sysmon config with Imphash logging activated'
+detection:
+    selection:
+        - Imphash:
+            - bcca3c247b619dcd13c8cdff5f123932 # PetitPotam
+            - 3a19059bd7688cb88e70005f18efc439 # PetitPotam
+            - bf6223a49e45d99094406777eb6004ba # PetitPotam
+            - 0c106686a31bfe2ba931ae1cf6e9dbc6 # Mimikatz
+            - 0d1447d4b3259b3c2a1d4cfb7ece13c3 # Mimikatz
+            - 1b0369a1e06271833f78ffa70ffb4eaf # Mimikatz
+            - 4c1b52a19748428e51b14c278d0f58e3 # Mimikatz
+            - 4d927a711f77d62cebd4f322cb57ec6f # Mimikatz
+            - 66ee036df5fc1004d9ed5e9a94a1086a # Mimikatz
+            - 672b13f4a0b6f27d29065123fe882dfc # Mimikatz
+            - 6bbd59cea665c4afcc2814c1327ec91f # Mimikatz
+            - 725bb81dc24214f6ecacc0cfb36ad30d # Mimikatz
+            - 9528a0e91e28fbb88ad433feabca2456 # Mimikatz
+            - 9da6d5d77be11712527dcab86df449a3 # Mimikatz
+            - a6e01bc1ab89f8d91d9eab72032aae88 # Mimikatz
+            - b24c5eddaea4fe50c6a96a2a133521e4 # Mimikatz
+            - d21bbc50dcc169d7b4d0f01962793154 # Mimikatz
+            - fcc251cceae90d22c392215cc9a2d5d6 # Mimikatz
+            - 23867a89c2b8fc733be6cf5ef902f2d1 # JuicyPotato 
+            - a37ff327f8d48e8a4d2f757e1b6e70bc # JuicyPotato 
+            - 6118619783fc175bc7ebecff0769b46e # RoguePotato
+            - 959a83047e80ab68b368fdb3f4c6e4ea # RoguePotato
+            - 563233bfa169acc7892451f71ad5850a # RoguePotato
+            - 87575cb7a0e0700eb37f2e3668671a08 # RoguePotato
+            - 13f08707f759af6003837a150a371ba1 # Pwdump
+            - 1781f06048a7e58b323f0b9259be798b # Pwdump
+            - 233f85f2d4bc9d6521a6caae11a1e7f5 # Pwdump
+            - 24af2584cbf4d60bbe5c6d1b31b3be6d # Pwdump
+            - 632969ddf6dbf4e0f53424b75e4b91f2 # Pwdump
+            - 713c29b396b907ed71a72482759ed757 # Pwdump
+            - 749a7bb1f0b4c4455949c0b2bf7f9e9f # Pwdump
+            - 8628b2608957a6b0c6330ac3de28ce2e # Pwdump
+            - 8b114550386e31895dfab371e741123d # Pwdump
+            - 94cb940a1a6b65bed4d5a8f849ce9793 # PwDumpX
+            - 9d68781980370e00e0bd939ee5e6c141 # Pwdump
+            - b18a1401ff8f444056d29450fbc0a6ce # Pwdump
+            - cb567f9498452721d77a451374955f5f # Pwdump
+            - 730073214094cd328547bf1f72289752 # Htran
+            - 17b461a082950fc6332228572138b80c # Cobalt Strike beacons
+            - dc25ee78e2ef4d36faa0badf1e7461c9 # Cobalt Strike beacons
+            - 819b19d53ca6736448f9325a85736792 # Cobalt Strike beacons
+            - 829da329ce140d873b4a8bde2cbfaa7e # Cobalt Strike beacons
+            - c547f2e66061a8dffb6f5a3ff63c0a74 # PPLDump
+            - 0588081ab0e63ba785938467e1b10cca # PPLDump
+            - 0d9ec08bac6c07d9987dfd0f1506587c # NanoDump
+            - bc129092b71c89b4d4c8cdf8ea590b29 # NanoDump
+            - 4da924cf622d039d58bce71cdf05d242 # NanoDump
+            - e7a3a5c377e2d29324093377d7db1c66 # NanoDump
+            - 9a9dbec5c62f0380b4fa5fd31deffedf # NanoDump
+            - af8a3976ad71e5d5fdfb67ddb8dadfce # NanoDump
+            - 0c477898bbf137bbd6f2a54e3b805ff4 # NanoDump
+            - 0ca9f02b537bcea20d4ea5eb1a9fe338 # NanoDump
+            - 3ab3655e5a14d4eefc547f4781bf7f9e # NanoDump
+            - e6f9d5152da699934b30daab206471f6 # NanoDump
+            - 3ad59991ccf1d67339b319b15a41b35d # NanoDump
+            - ffdd59e0318b85a3e480874d9796d872 # NanoDump
+            - 0cf479628d7cc1ea25ec7998a92f5051 # NanoDump
+            - 07a2d4dcbd6cb2c6a45e6b101f0b6d51 # NanoDump
+            - d6d0f80386e1380d05cb78e871bc72b1 # NanoDump
+            - 38d9e015591bbfd4929e0d0f47fa0055 # HandleKatz
+            - 0e2216679ca6e1094d63322e3412d650 # HandleKatz
+            - ada161bf41b8e5e9132858cb54cab5fb # DripLoader
+            - 2a1bc4913cd5ecb0434df07cb675b798 # DripLoader
+            - 11083e75553baae21dc89ce8f9a195e4 # DripLoader
+            - a23d29c9e566f2fa8ffbb79267f5df80 # DripLoader
+        - Hashes|contains:  # Sysmon field hashes contains all types
+            - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 # PetitPotam
+            - IMPHASH=3A19059BD7688CB88E70005F18EFC439 # PetitPotam
+            - IMPHASH=bf6223a49e45d99094406777eb6004ba # PetitPotam
+            - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 # Mimikatz
+            - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 # Mimikatz
+            - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF # Mimikatz
+            - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 # Mimikatz
+            - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F # Mimikatz
+            - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A # Mimikatz
+            - IMPHASH=672B13F4A0B6F27D29065123FE882DFC # Mimikatz
+            - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F # Mimikatz
+            - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D # Mimikatz
+            - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 # Mimikatz
+            - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 # Mimikatz
+            - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 # Mimikatz
+            - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 # Mimikatz
+            - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 # Mimikatz
+            - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 # Mimikatz
+            - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 # JuicyPotato 
+            - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC # JuicyPotato 
+            - IMPHASH=6118619783FC175BC7EBECFF0769B46E # RoguePotato
+            - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA # RoguePotato
+            - IMPHASH=563233BFA169ACC7892451F71AD5850A # RoguePotato
+            - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 # RoguePotato
+            - IMPHASH=13F08707F759AF6003837A150A371BA1 # Pwdump
+            - IMPHASH=1781F06048A7E58B323F0B9259BE798B # Pwdump
+            - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 # Pwdump
+            - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D # Pwdump
+            - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 # Pwdump
+            - IMPHASH=713C29B396B907ED71A72482759ED757 # Pwdump
+            - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F # Pwdump
+            - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E # Pwdump
+            - IMPHASH=8B114550386E31895DFAB371E741123D # Pwdump
+            - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 # PwDumpX
+            - IMPHASH=9D68781980370E00E0BD939EE5E6C141 # Pwdump
+            - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE # Pwdump
+            - IMPHASH=CB567F9498452721D77A451374955F5F # Pwdump
+            - IMPHASH=730073214094CD328547BF1F72289752 # Htran
+            - IMPHASH=17B461A082950FC6332228572138B80C # Cobalt Strike beacons
+            - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 # Cobalt Strike beacons
+            - IMPHASH=819B19D53CA6736448F9325A85736792 # Cobalt Strike beacons
+            - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E # Cobalt Strike beacons
+            - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 # PPLDump
+            - IMPHASH=0588081AB0E63BA785938467E1B10CCA # PPLDump
+            - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C # NanoDump
+            - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 # NanoDump
+            - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 # NanoDump
+            - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 # NanoDump
+            - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF # NanoDump
+            - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE # NanoDump
+            - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 # NanoDump
+            - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 # NanoDump
+            - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E # NanoDump
+            - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 # NanoDump
+            - IMPHASH=3AD59991CCF1D67339B319B15A41B35D # NanoDump
+            - IMPHASH=FFDD59E0318B85A3E480874D9796D872 # NanoDump
+            - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 # NanoDump
+            - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 # NanoDump
+            - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 # NanoDump
+            - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 # HandleKatz
+            - IMPHASH=0E2216679CA6E1094D63322E3412D650 # HandleKatz
+            - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB # DripLoader
+            - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 # DripLoader
+            - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 # DripLoader
+            - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 # DripLoader
+    condition: selection
+fields:
+  - TargetFilename
+  - Image
+falsepositives:
+  - Unknown
+level: high
+tags:
+  - attack.defense_evasion
+  - attack.s0139
+  - attack.t1564.004
diff --git a/rules/windows/create_stream_hash/create_stream_hash_susp_domain_ext_combo.yml b/rules/windows/create_stream_hash/create_stream_hash_susp_domain_ext_combo.yml
new file mode 100644
index 000000000..7285e6ce2
--- /dev/null
+++ b/rules/windows/create_stream_hash/create_stream_hash_susp_domain_ext_combo.yml
@@ -0,0 +1,46 @@
+title: Suspicious File Download from File Sharing Domain
+id: 35fda18e-8b57-409a-a13c-80dec8873346
+status: experimental
+description: Detects the download of suspicious file type from a well-known file and paste sharing domain
+author: Florian Roth
+references:
+  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015
+date: 2022/08/24
+logsource:
+  product: windows
+  category: create_stream_hash
+  definition: 'Requirements: Sysmon config with Imphash logging activated'
+detection:
+    selection_domain:
+        Contents|contains:
+            - 'https://transfer.sh/'
+            - 'raw.githubusercontent.com'
+            - 'gist.githubusercontent.com'
+            - 'pastebin.com'
+            - 'cdn.discordapp.com/attachments/'
+            - 'mediafire.com'
+            - 'mega.nz'
+            - 'ddns.net'
+            - '.paste.ee'
+            - '.hastebin.com'
+            - '.ghostbin.co/'
+            - 'ufile.io'
+            - 'storage.googleapis.com'
+            - 'anonfiles.com'
+            - 'send.exploit.in'
+    selection_extension:
+        TargetFilename|contains:
+            - '.exe:Zone'
+            - '.vbs:Zone'
+            - '.dll:Zone'
+    condition: all of selection*
+fields:
+  - TargetFilename
+  - Image
+falsepositives:
+  - Unknown
+level: high
+tags:
+  - attack.defense_evasion
+  - attack.s0139
+  - attack.t1564.004
diff --git a/rules/windows/create_stream_hash/create_stream_hash_susp_domain_ext_combo_med.yml b/rules/windows/create_stream_hash/create_stream_hash_susp_domain_ext_combo_med.yml
new file mode 100644
index 000000000..4a45cd316
--- /dev/null
+++ b/rules/windows/create_stream_hash/create_stream_hash_susp_domain_ext_combo_med.yml
@@ -0,0 +1,45 @@
+title: Unusual File Download from File Sharing Domain
+id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
+status: experimental
+description: Detects the download of suspicious file type from a well-known file and paste sharing domain
+author: Florian Roth
+references:
+  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015
+date: 2022/08/24
+logsource:
+  product: windows
+  category: create_stream_hash
+  definition: 'Requirements: Sysmon config with Imphash logging activated'
+detection:
+    selection_domain:
+        Contents|contains:
+            - 'transfer.sh'
+            - 'raw.githubusercontent.com'
+            - 'gist.githubusercontent.com'
+            - 'pastebin.com'
+            - 'cdn.discordapp.com/attachments/'
+            - 'mediafire.com'
+            - 'mega.nz'
+            - 'ddns.net'
+            - '.paste.ee'
+            - '.hastebin.com'
+            - '.ghostbin.co/'
+            - 'ufile.io'
+            - 'storage.googleapis.com'
+            - 'anonfiles.com'
+            - 'send.exploit.in'
+    selection_extension:
+        TargetFilename|contains:
+            - '.ps1:Zone'
+            - '.bat:Zone'
+    condition: all of selection*
+fields:
+  - TargetFilename
+  - Image
+falsepositives:
+  - Unknown
+level: medium
+tags:
+  - attack.defense_evasion
+  - attack.s0139
+  - attack.t1564.004