From c886b671ce94c5b9449f8ce210470f8d16dcc232 Mon Sep 17 00:00:00 2001 From: Carlos Perez Date: Tue, 28 Jan 2020 12:07:19 -0400 Subject: [PATCH] Fix typos in File Stream Creation Hash File Stream Creation Hash --- file-stream-creation-hash.md | 42 +++++++++--------------------------- 1 file changed, 10 insertions(+), 32 deletions(-) diff --git a/file-stream-creation-hash.md b/file-stream-creation-hash.md index 90d4707..a4aac75 100644 --- a/file-stream-creation-hash.md +++ b/file-stream-creation-hash.md @@ -1,14 +1,9 @@ File Stream Creation Hash ========================= -Sysmon will log EventID 15 for the creation of Alternate Data Streams. -This is an old technique where many vendors already monitor for the -creation of ADS on files where the alternate stream is a PE executable. -Attackers have changed to use alternate streams to hide information and -to store other payloads that are not PE executables (DLL, Scripts) +Sysmon will log **EventID 15** for the creation of Alternate Data Streams (ADS). This is an old technique where many vendors already monitor for the creation of ADS on files where the alternate stream is a PE executable. Attackers have changed to use alternate streams to hide information and to store other payloads that are not PE executables (DLL, Scripts). -Each record in NTFS on a drive is subdivided into a list of variable -length Attributes: +Each record in NTFS on a drive is subdivided into a list of variable length attributes: * \$STANDARD\_INFORMATION @@ -31,13 +26,11 @@ attributes * Alternate streams are named ones. -Since streams are part of the NTFS structure directories may have an AD, -we can use PowerShell to look at a file with the single default unamend -:\$DATA stream +Since streams that are part of the NTFS structure directories may have an AD, we can use PowerShell to look at a file with the single default unamend :\$DATA stream: ![stream1](./media/image41.png) -File with a second named stream +File with a second named stream: ![stream2](./media/image42.png) @@ -55,31 +48,16 @@ Oddvar Moe The fields for the event: -* **RuleName**: Name of rule that triggered the event. - +* **RuleName**: Name of rule that triggered the event * **UtcTime**: Time in UTC when event was created - -* **ProcessGuid**: Process Guid of the process that created the named - file stream - -* **ProcessId**: Process ID used by the OS to identify the process - that created the named file stream - -* **Image**: File path of the process that created the named file - stream - +* **ProcessGuid**: Process GUID of the process that created the named file stream +* **ProcessId**: Process ID used by the OS to identify the process that created the named file stream +* **Image**: File path of the process that created the named file stream * **TargetFilename**: Name of the file - * **CreationUtcTime**: File download time +* **Hash**: Full hash of the file with the algorithms in the HashType field -* **Hash**:Full hash of the file with the algorithms in the HashType - field - -The number of processes that create alternate streams should be low and -easy excluded. Normally mail clients and browsers are the main -generators of this event in normal operation to set the Zone attribute. -Because of this a maintenance process is recommended when leveraging -these filters. +The number of processes that create alternate streams should be low and easily excluded. Mail clients and browsers are the main generators of this event in normal operation to set the Zone attribute; Because of this, a maintenance process is recommended when leveraging these filters. ![process](./media/image43.png)