Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
89
32
9
5
4
Contributors
42
39
20
10
8
Categories
80
53
26
17
15
Platforms
144
1
1
Products / Services
51
27
25
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
6
5
5
IDS Classtypes
1
IDS Protocols
1
Exports the target Registry key and hides it in the specified alternate data stream.
Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
Extract data from cab file and hide it in an alternate data stream
Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection
Detects the execution of PowerShell commands using the Remove-Item cmdlet to explicitly target and delete the :Zone.Identifier Alternate Data Stream (ADS). This technique is commonly used by adversaries to evade Mark-of-the-Web (MOTW) detection and make downloaded malicious files appear less suspicious.
Detects the deletion of the ':Zone.Identifier' Alternate Data Stream (ADS) from a file. This is a technique used by malware like Phorpiex to remove the Mark-of-the-Web and bypass security warnings on downloaded files.
Detects the use of Windows 8.3 short filenames (e.g., `PROGRA~1`) in process image paths. This technique can be used by adversaries to evade detection mechanisms that rely on full file paths, as the short name might bypass certain allow-listing or block-listing rules.
The following analytic detects the creation of Alternate Data Streams (ADS) with Base64 content on Windows systems. It leverages Sysmon EventID 15, which captures file creation events, including the content of named streams. ADS can conceal malicious payloads, making them significant for SOC monitoring. This detection identifies hidden streams that may contain executables, scripts, or configuration data, often used by malware to evade detection. If confirmed malicious, this activity could allow attackers to hide and execute payloads, persist in the environment, or access sensitive information without being easily detected.
Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs. This technique can be used to bypass security controls, especially in web servers on Windows.
Detects the download of suspicious file types (executables, DLLs, scripts, etc.) from well-known file and paste sharing domains. The detection specifically looks for the creation of Alternate Data Streams (ADS) with a ':Zone' identifier, which indicates the file was downloaded from the internet and carries Mark-of-the-Web.
Detects the download of suspicious file types (batch, command, PowerShell scripts) from well-known file and paste sharing domains. This rule specifically looks for the creation of Zone.Identifier alternate data streams on these file types, which indicates they were downloaded from the internet.
Detects the execution of "findstr" with specific command-line flags and a remote share path. This combination of flags allows "findstr" to download the content of a file located on a remote share, as described in the LOLBAS project. This technique can be used for ingress tool transfer or data staging.
Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism
Detects the creation of a named file stream with the imphash of a well-known hack tool
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
Page 4 of 7