create_stream_hash | Detection.FYI

HackTool Named File Stream Created

Nov 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the creation of a named file stream with the imphash of a well-known hack tool

Read More
Suspicious File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
Unusual File Download From File Sharing Websites - File Stream

Oct 25, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Read More
Creation Of a Suspicious ADS File Outside a Browser Download

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers

Read More
Exports Registry Key To an Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Exports the target Registry key and hides it in the specified alternate data stream.

Read More
Hidden Executable In NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·
Share on:

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

Read More
Potential Suspicious Winget Package Installation

Aug 12, 2024 · attack.defense-evasion attack.persistence ·
Share on:

Detects potential suspicious winget package installation from a suspicious source.

Read More
Potentially Suspicious File Download From ZIP TLD

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the download of a file with a potentially suspicious extension from a .zip top level domain.

Read More
Unusual File Download from Direct IP Address

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·
Share on:

Detects the download of suspicious file type from URLs with IP

Read More