EXPLORE
Sign In
← Back to Explore
sigmahighHunting

HackTool Named File Stream Created

Detects the creation of a named file stream with the imphash of a well-known hack tool

MITRE ATT&CK

S0139T1564.004
defense-evasion

Detection Query

selection:
  Hash|contains:
    - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932
    - IMPHASH=3A19059BD7688CB88E70005F18EFC439
    - IMPHASH=bf6223a49e45d99094406777eb6004ba
    - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6
    - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3
    - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF
    - IMPHASH=4C1B52A19748428E51B14C278D0F58E3
    - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F
    - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A
    - IMPHASH=672B13F4A0B6F27D29065123FE882DFC
    - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F
    - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D
    - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456
    - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3
    - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88
    - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4
    - IMPHASH=D21BBC50DCC169D7B4D0F01962793154
    - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6
    - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1
    - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC
    - IMPHASH=F9A28C458284584A93B14216308D31BD
    - IMPHASH=6118619783FC175BC7EBECFF0769B46E
    - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA
    - IMPHASH=563233BFA169ACC7892451F71AD5850A
    - IMPHASH=87575CB7A0E0700EB37F2E3668671A08
    - IMPHASH=13F08707F759AF6003837A150A371BA1
    - IMPHASH=1781F06048A7E58B323F0B9259BE798B
    - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5
    - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D
    - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2
    - IMPHASH=713C29B396B907ED71A72482759ED757
    - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F
    - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E
    - IMPHASH=8B114550386E31895DFAB371E741123D
    - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793
    - IMPHASH=9D68781980370E00E0BD939EE5E6C141
    - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE
    - IMPHASH=CB567F9498452721D77A451374955F5F
    - IMPHASH=730073214094CD328547BF1F72289752
    - IMPHASH=17B461A082950FC6332228572138B80C
    - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9
    - IMPHASH=819B19D53CA6736448F9325A85736792
    - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E
    - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74
    - IMPHASH=0588081AB0E63BA785938467E1B10CCA
    - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C
    - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29
    - IMPHASH=4DA924CF622D039D58BCE71CDF05D242
    - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66
    - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF
    - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE
    - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4
    - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338
    - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E
    - IMPHASH=E6F9D5152DA699934B30DAAB206471F6
    - IMPHASH=3AD59991CCF1D67339B319B15A41B35D
    - IMPHASH=FFDD59E0318B85A3E480874D9796D872
    - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051
    - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51
    - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1
    - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055
    - IMPHASH=0E2216679CA6E1094D63322E3412D650
    - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB
    - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798
    - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4
    - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80
    - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F
    - IMPHASH=767637C23BB42CD5D7397CF58B0BE688
    - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8
    - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC
    - IMPHASH=7D010C6BB6A3726F327F7E239166D127
    - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3
    - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F
    - IMPHASH=5834ED4291BDEB928270428EBBAF7604
    - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38
    - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894
    - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74
    - IMPHASH=3DE09703C8E79ED2CA3F01074719906B
    - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F
    - IMPHASH=E96A73C7BF33A464C510EDE582318BF2
    - IMPHASH=32089B8851BBF8BC2D014E9F37288C83
    - IMPHASH=09D278F9DE118EF09163C6140255C690
    - IMPHASH=03866661686829d806989e2fc5a72606
    - IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d
    - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE
    - IMPHASH=19584675D94829987952432E018D5056
    - IMPHASH=330768A4F172E10ACB6287B87289D83B
    - IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313
    - IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC
    - IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28
    - IMPHASH=96DF3A3731912449521F6F8D183279B1
    - IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46
    - IMPHASH=51791678F351C03A0EB4E2A7B05C6E17
    - IMPHASH=25CE42B079282632708FC846129E98A5
    - IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20
    - IMPHASH=59223B5F52D8799D38E0754855CBDF42
    - IMPHASH=81E75D8F1D276C156653D3D8813E4A43
    - IMPHASH=17244E8B6B8227E57FE709CCAD421420
    - IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4
    - IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C
    - IMPHASH=40445337761D80CF465136FAFB1F63E6
    - IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6
condition: selection

Author

Florian Roth (Nextron Systems)

Created

2022-08-24

Data Sources

windowscreate_stream_hash

Platforms

windows

References

Tags

attack.defense-evasionattack.s0139attack.t1564.004
Raw Content
title: HackTool Named File Stream Created
id: 19b041f6-e583-40dc-b842-d6fa8011493f
status: test
description: Detects the creation of a named file stream with the imphash of a well-known hack tool
references:
    - https://github.com/gentilkiwi/mimikatz
    - https://github.com/topotam/PetitPotam
    - https://github.com/ohpe/juicy-potato
    - https://github.com/antonioCoco/RoguePotato
    - https://www.tarasco.org/security/pwdump_7/
    - https://github.com/fortra/nanodump
    - https://github.com/codewhitesec/HandleKatz
    - https://github.com/xuanxuan0/DripLoader
    - https://github.com/hfiref0x/UACME
    - https://github.com/outflanknl/Dumpert
    - https://github.com/wavestone-cdt/EDRSandblast
author: Florian Roth (Nextron Systems)
date: 2022-08-24
modified: 2024-11-23
tags:
    - attack.defense-evasion
    - attack.s0139
    - attack.t1564.004
logsource:
    product: windows
    category: create_stream_hash
    definition: 'Requirements: Sysmon config with Imphash logging activated'
detection:
    selection:
        Hash|contains: # Sysmon field hashes contains all types
            - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 # PetitPotam
            - IMPHASH=3A19059BD7688CB88E70005F18EFC439 # PetitPotam
            - IMPHASH=bf6223a49e45d99094406777eb6004ba # PetitPotam
            - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 # Mimikatz
            - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 # Mimikatz
            - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF # Mimikatz
            - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 # Mimikatz
            - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F # Mimikatz
            - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A # Mimikatz
            - IMPHASH=672B13F4A0B6F27D29065123FE882DFC # Mimikatz
            - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F # Mimikatz
            - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D # Mimikatz
            - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 # Mimikatz
            - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 # Mimikatz
            - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 # Mimikatz
            - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 # Mimikatz
            - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 # Mimikatz
            - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 # Mimikatz
            - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 # JuicyPotato
            - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC # JuicyPotato
            - IMPHASH=F9A28C458284584A93B14216308D31BD # JuicyPotatoNG
            - IMPHASH=6118619783FC175BC7EBECFF0769B46E # RoguePotato
            - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA # RoguePotato
            - IMPHASH=563233BFA169ACC7892451F71AD5850A # RoguePotato
            - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 # RoguePotato
            - IMPHASH=13F08707F759AF6003837A150A371BA1 # Pwdump
            - IMPHASH=1781F06048A7E58B323F0B9259BE798B # Pwdump
            - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 # Pwdump
            - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D # Pwdump
            - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 # Pwdump
            - IMPHASH=713C29B396B907ED71A72482759ED757 # Pwdump
            - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F # Pwdump
            - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E # Pwdump
            - IMPHASH=8B114550386E31895DFAB371E741123D # Pwdump
            - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 # PwDumpX
            - IMPHASH=9D68781980370E00E0BD939EE5E6C141 # Pwdump
            - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE # Pwdump
            - IMPHASH=CB567F9498452721D77A451374955F5F # Pwdump
            - IMPHASH=730073214094CD328547BF1F72289752 # Htran
            - IMPHASH=17B461A082950FC6332228572138B80C # Cobalt Strike beacons
            - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 # Cobalt Strike beacons
            - IMPHASH=819B19D53CA6736448F9325A85736792 # Cobalt Strike beacons
            - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E # Cobalt Strike beacons
            - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 # PPLDump
            - IMPHASH=0588081AB0E63BA785938467E1B10CCA # PPLDump
            - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C # NanoDump
            - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 # NanoDump
            - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 # NanoDump
            - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 # NanoDump
            - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF # NanoDump
            - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE # NanoDump
            - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 # NanoDump
            - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 # NanoDump
            - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E # NanoDump
            - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 # NanoDump
            - IMPHASH=3AD59991CCF1D67339B319B15A41B35D # NanoDump
            - IMPHASH=FFDD59E0318B85A3E480874D9796D872 # NanoDump
            - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 # NanoDump
            - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 # NanoDump
            - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 # NanoDump
            - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 # HandleKatz
            - IMPHASH=0E2216679CA6E1094D63322E3412D650 # HandleKatz
            - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB # DripLoader
            - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 # DripLoader
            - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 # DripLoader
            - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 # DripLoader
            - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F # CreateMiniDump
            - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 # UACMe Akagi
            - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 # UACMe Akagi
            - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC # UACMe Akagi
            - IMPHASH=7D010C6BB6A3726F327F7E239166D127 # UACMe Akagi
            - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 # UACMe Akagi
            - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F # UACMe Akagi
            - IMPHASH=5834ED4291BDEB928270428EBBAF7604 # UACMe Akagi
            - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 # UACMe Akagi
            - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 # UACMe Akagi
            - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 # UACMe Akagi
            - IMPHASH=3DE09703C8E79ED2CA3F01074719906B # UACMe Akagi
            - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F # WCE
            - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 # WCE
            - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 # Sliver Stagers
            - IMPHASH=09D278F9DE118EF09163C6140255C690 # Dumpert
            - IMPHASH=03866661686829d806989e2fc5a72606 # Dumpert
            - IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d # Dumpert
            - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE # SysmonEnte
            - IMPHASH=19584675D94829987952432E018D5056 # SysmonQuiet
            - IMPHASH=330768A4F172E10ACB6287B87289D83B # ShaprEvtMute Hook
            - IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 # Forkatz
            - IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC # PPLKiller
            - IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 # PPLKiller
            - IMPHASH=96DF3A3731912449521F6F8D183279B1 # Backstab
            - IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 # Backstab
            - IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 # Backstab
            - IMPHASH=25CE42B079282632708FC846129E98A5 # Forensia
            - IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20 # EDRSandBlast
            - IMPHASH=59223B5F52D8799D38E0754855CBDF42 # EDRSandBlast
            - IMPHASH=81E75D8F1D276C156653D3D8813E4A43 # EDRSandBlast
            - IMPHASH=17244E8B6B8227E57FE709CCAD421420 # EDRSandBlast
            - IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4 # EDRSandBlast
            - IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C # EDRSandBlast
            - IMPHASH=40445337761D80CF465136FAFB1F63E6 # EDRSandBlast
            - IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6 # EDRSilencer
    condition: selection
falsepositives:
    - Unknown
level: high