admin/trustedsec-SysmonCommunityGuide
1
0
Fork 0
mirror of https://github.com/trustedsec/SysmonCommunityGuide/ synced 2026-06-06 19:46:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix typos in File Stream Creation Hash

Browse Source 
File Stream Creation Hash
This commit is contained in:
Carlos Perez
2020-01-28 12:07:19 -04:00
committed by GitHub
parent 7b9eb292c3
commit c886b671ce
1 changed files with 10 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
file-stream-creation-hash.md
+10 -32
View File
@@ -1,14 +1,9 @@
File Stream Creation Hash
=========================
Sysmon will log EventID 15 for the creation of Alternate Data Streams.
This is an old technique where many vendors already monitor for the
creation of ADS on files where the alternate stream is a PE executable.
Attackers have changed to use alternate streams to hide information and
to store other payloads that are not PE executables (DLL, Scripts)
Sysmon will log **EventID 15** for the creation of Alternate Data Streams (ADS). This is an old technique where many vendors already monitor for the creation of ADS on files where the alternate stream is a PE executable. Attackers have changed to use alternate streams to hide information and to store other payloads that are not PE executables (DLL, Scripts).
Each record in NTFS on a drive is subdivided into a list of variable
length Attributes:
Each record in NTFS on a drive is subdivided into a list of variable length attributes:
* \$STANDARD\_INFORMATION
@@ -31,13 +26,11 @@ attributes
* Alternate streams are named ones.
Since streams are part of the NTFS structure directories may have an AD,
we can use PowerShell to look at a file with the single default unamend
:\$DATA stream
Since streams that are part of the NTFS structure directories may have an AD, we can use PowerShell to look at a file with the single default unamend :\$DATA stream:
![stream1](./media/image41.png)
File with a second named stream
File with a second named stream:
![stream2](./media/image42.png)
@@ -55,31 +48,16 @@ Oddvar Moe
The fields for the event:
* **RuleName**: Name of rule that triggered the event.
* **RuleName**: Name of rule that triggered the event
* **UtcTime**: Time in UTC when event was created
* **ProcessGuid**: Process Guid of the process that created the named
file stream
* **ProcessId**: Process ID used by the OS to identify the process
that created the named file stream
* **Image**: File path of the process that created the named file
stream
* **ProcessGuid**: Process GUID of the process that created the named file stream
* **ProcessId**: Process ID used by the OS to identify the process that created the named file stream
* **Image**: File path of the process that created the named file stream
* **TargetFilename**: Name of the file
* **CreationUtcTime**: File download time
* **Hash**: Full hash of the file with the algorithms in the HashType field
* **Hash**:Full hash of the file with the algorithms in the HashType
field
The number of processes that create alternate streams should be low and
easy excluded. Normally mail clients and browsers are the main
generators of this event in normal operation to set the Zone attribute.
Because of this a maintenance process is recommended when leveraging
these filters.
The number of processes that create alternate streams should be low and easily excluded. Mail clients and browsers are the main generators of this event in normal operation to set the Zone attribute; Because of this, a maintenance process is recommended when leveraging these filters.
![process](./media/image43.png)