Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
30
24
10
2
2
Contributors
20
14
10
9
6
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
71
1
Products / Services
38
22
4
3
2
MITRE Techniques
65
53
9
6
5
CVEs
4
1
IDS Classtypes
1
IDS Protocols
1
This rule detects when 'regedit.exe' is used to export a registry key to an Alternate Data Stream (ADS). This technique can be used by adversaries to hide data, such as exported registry keys, within existing files to evade detection. The rule specifically looks for the execution of 'regedit.exe' which is a legitimate Windows utility, making the detection focused on its suspicious usage in conjunction with ADS.
Detects the download of suspicious file types from URLs containing direct IP addresses. This rule specifically looks for the creation of Zone.Identifier alternate data streams (ADS) for common executable or script file extensions, indicating a file downloaded from the internet, combined with a URL that uses an IP address instead of a domain name. This behavior can be indicative of malware delivery or staging.
Detects the creation of a suspicious Alternate Data Stream (ADS) file, specifically a ':Zone.Identifier' stream, by processes other than common web browsers. The ':Zone.Identifier' ADS is used by Windows to mark files downloaded from the internet, indicating their origin and often triggering security warnings. This rule looks for the creation of this ADS with a 'ZoneId=3' (indicating an internet origin) on executable or document file types. By filtering out known browser processes, the rule aims to identify instances where other applications or scripts might be creating these ADS files, potentially as a defense evasion technique to bypass security warnings or to masquerade malicious files.
Detects the creation of an Alternate Data Stream (ADS) named ':Zone.Identifier' within the WinGet temporary directory, specifically when the ZoneId is '3' (Internet) and the source URL contains suspicious IP address patterns (e.g., '://1', '://2', etc.). This indicates a file downloaded from the internet via WinGet that might originate from an untrusted or suspicious source, potentially used for defense evasion or persistence.
Detects the download of a file with a potentially suspicious extension from a .zip top-level domain. This rule specifically looks for the creation of alternate data streams (ADS) containing a 'Zone.Identifier' indicating a download from a '.zip' TLD, combined with suspicious file extensions commonly used for malicious payloads.
This rule detects PowerShell commands that attempt to store data in an Alternate Data Stream (ADS) by redirecting the output of a command executed via `cmd.exe` (comspec) into a file using the `>` operator. This technique is often used by malware, such as Astaroth, to hide malicious data within legitimate files, making it harder to detect.
Detects attempts to write data into NTFS Alternate Data Streams (ADS) using PowerShell cmdlets like `Set-Content` or `Add-Content` in conjunction with the `-Stream` parameter. This technique can be used by adversaries to hide malicious data or executables on a system.
Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
Page 4 of 4