cuckoobox/community — pull request #4 by mboman (2012-08-15 20:08:50+00:00)
Title: Created signature to look for the creation of empty files

I created a signature which alerts on empty files. It can trigger on NTFS ADS (Alternative Data Streams), which Cuckoo currently can't grab, as well as when the malware tries to hide it's tracks by overwriting the file.