Query: Sigma YAML for windows / create_stream_hash
Matching passage: Sigma rule: Detects the creation of a named file stream with the imphash of a well-known hack tool. Logsource: windows / create_stream_hash. Rule: title: HackTool Named File Stream Created id: 19b041f6-e583-40dc-b842-d6fa8011493f status: test description: Detects the creation of a named file stream with the imphash of a well-known hack tool references: - https://github.com/gentilkiwi/mimikatz - https://github.com/topotam/PetitPotam - https://github.com/ohpe/juicy-potato - https://github.com/antonioCoco/RoguePotato - https://www.tarasco.org/security/pwdump_7/ - https://github.com/fortra/nanodump - https://github.com/codewhitesec/HandleKatz - https://github.com/xuanxuan0/DripLoader - https://github.com/hfiref0x/UACME - https://github.com/outflanknl/Dumpert - https://github.com/wavestone-cdt/EDRSandblast author: Florian Roth (Nextron Systems) date: 2022-08-24 modified: 2024-11-23 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon config with Imphash logging activated' detection: selection: Hash|contains: - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0
Near-miss passage: Sigma rule: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make i. Logsource: windows / registry_delete. Rule: title: Delete Defender Scan ShellEx Context Menu Registry Key id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6 related: - id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b type: similar status: experimental description: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious. references: - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/ - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/ - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ author: Matt Anderson (Huntress) date: 2025-07-11 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: registry_delete product: windows detection: selection: TargetObject|contains: shellex\ContextMenuHandlers\EPP filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely as this weakens defenses and normally would not be done even if using another AV. level: medium