Suspicious File Download from File Sharing Websites with Mark-of-the-Web

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•2•0•29

Detects the download of suspicious file types (executables, DLLs, scripts, etc.) from well-known file and paste sharing domains. The detection specifically looks for the creation of Alternate Data Streams (ADS) with a ':Zone' identifier, which indicates the file was downloaded from the internet and carries Mark-of-the-Web.