Zone.Identifier stream stamped onto a container or disk image file

Siemphony@siemphonylowT1553.005unverifiedPlaybook · Defence evasion

AN0712 wants a three-way correlation: a container/archive/disk-image file arriving from the Internet, its contained files failing to inherit Zone.Identifier once extracted or mounted, and an untrusted binary executing from inside it. MITRE's TimeWindow knob names the join and Sigma has no operator to hold it together, and no logsource in this brief carries process_creation at all — only file_event, a 4670/4656 permission-change pairing, and create_stream_hash — so the execution leg is unreachable from here regardless of what the analytic description asks for. What a single event CAN carry is the precursor: the moment the container file itself is tagged with the Internet zone, which is the precondition for this bypass to matter at all (a container built locally never triggers it). This rule matches Sysmon EventID 15 where the streamed file is one of the watched container/archive/disk-image extensions and the stream content records ZoneId=3, the Internet zone specifically (not Intranet, Trusted or Restricted). It cannot see whether files subsequently extracted or mounted from that container inherited MOTW or not — that absence is not an event Sigma can match on — so a hit here means "an archive arrived from the Internet," not "MOTW was bypassed"; treat it as a lead for a manual check of the contents, not as confirmation of the technique. EventID 15 is not emitted by a bare Sysmon install, and most shipped configurations restrict stream hashing to a short extension list that excludes archive and disk-image types, so confirm MITRE's WatchedExtensions knob is actually configured to cover these before relying on silence. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0257, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Zone.Identifier stream stamped onto a container or disk image file2id: be41f99a-b438-4b87-8a92-6a36eb5164053status: experimental4description: |5  AN0712 wants a three-way correlation: a container/archive/disk-image file6  arriving from the Internet, its contained files failing to inherit7  Zone.Identifier once extracted or mounted, and an untrusted binary executing8  from inside it. MITRE's TimeWindow knob names the join and Sigma has no9  operator to hold it together, and no logsource in this brief carries10  process_creation at all — only file_event, a 4670/4656 permission-change11  pairing, and create_stream_hash — so the execution leg is unreachable from12  here regardless of what the analytic description asks for. What a single13  event CAN carry is the precursor: the moment the container file itself is14  tagged with the Internet zone, which is the precondition for this bypass to15  matter at all (a container built locally never triggers it). This rule16  matches Sysmon EventID 15 where the streamed file is one of the watched17  container/archive/disk-image extensions and the stream content records18  ZoneId=3, the Internet zone specifically (not Intranet, Trusted or19  Restricted). It cannot see whether files subsequently extracted or mounted20  from that container inherited MOTW or not — that absence is not an event21  Sigma can match on — so a hit here means "an archive arrived from the22  Internet," not "MOTW was bypassed"; treat it as a lead for a manual check of23  the contents, not as confirmation of the technique. EventID 15 is not24  emitted by a bare Sysmon install, and most shipped configurations restrict25  stream hashing to a short extension list that excludes archive and26  disk-image types, so confirm MITRE's WatchedExtensions knob is actually27  configured to cover these before relying on silence.28  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0257, not hand-written and not tested by its author. Any lab result is on this rule's own page.29references:30  - https://attack.mitre.org/techniques/T1553/00531  - https://attack.mitre.org/detectionstrategies/DET025732author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)33date: 2026-08-1734tags:35  - attack.defense-evasion36  - attack.t1553.00537logsource:38  category: create_stream_hash39  product: windows40detection:41  selection:42    TargetFilename|endswith:43      - '.iso:Zone.Identifier'44      - '.img:Zone.Identifier'45      - '.vhd:Zone.Identifier'46      - '.vhdx:Zone.Identifier'47      - '.zip:Zone.Identifier'48      - '.rar:Zone.Identifier'49      - '.7z:Zone.Identifier'50      - '.gz:Zone.Identifier'51      - '.arj:Zone.Identifier'52    Contents|contains: 'ZoneId=3'53  condition: selection54falsepositives:55  - "IT and software-deployment downloads of ISO or VHD images for provisioning and imaging, such as OS media pulled by MDT, SCCM or a hypervisor's own image library — ordinary administrative work and the loudest source of matches here."56  - "Browsers and mail clients downloading legitimate archived software, drivers or installers packaged as .zip, .rar or .7z from a vendor site, which receive the identical Zone.Identifier stream as a malicious archive."57  - "Cloud storage and file-sync clients that write the Internet zone marker onto archives synchronised from a shared folder, independent of any user download action."58level: low

Splunk · SPL

Run this as a search.

index=* ((TargetFilename="*.iso:Zone.Identifier" OR TargetFilename="*.img:Zone.Identifier" OR TargetFilename="*.vhd:Zone.Identifier" OR TargetFilename="*.vhdx:Zone.Identifier" OR TargetFilename="*.zip:Zone.Identifier" OR TargetFilename="*.rar:Zone.Identifier" OR TargetFilename="*.7z:Zone.Identifier" OR TargetFilename="*.gz:Zone.Identifier" OR TargetFilename="*.arj:Zone.Identifier") AND Contents="*ZoneId=3*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*.iso:zone.identifier" OR TO_LOWER(file.path) LIKE "*.img:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vhd:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vhdx:zone.identifier" OR TO_LOWER(file.path) LIKE "*.zip:zone.identifier" OR TO_LOWER(file.path) LIKE "*.rar:zone.identifier" OR TO_LOWER(file.path) LIKE "*.7z:zone.identifier" OR TO_LOWER(file.path) LIKE "*.gz:zone.identifier" OR TO_LOWER(file.path) LIKE "*.arj:zone.identifier") AND TO_LOWER(winlog.event_data.Contents) LIKE "*zoneid=3*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,create_stream_hash,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\.iso:Zone\.Identifier$|\.img:Zone\.Identifier$|\.vhd:Zone\.Identifier$|\.vhdx:Zone\.Identifier$|\.zip:Zone\.Identifier$|\.rar:Zone\.Identifier$|\.7z:Zone\.Identifier$|\.gz:Zone\.Identifier$|\.arj:Zone\.Identifier$)</field>    <field name="Contents" type="pcre2">(?i)ZoneId=3</field>    <description>Zone.Identifier stream stamped onto a container or disk image file</description>    <mitre>      <id>T1553.005</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"create_stream_hash","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: create_stream_hash / windows
Level: low
Category: defense_evasion_subvert_trust
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: be41f99a-b438-4b87-8a92-6a36eb516405

ATT&CKT1553.005

T1553.005Mark-of-the-Web Bypass

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Noise checknot tested

No baseline event covers this rule’s log type (create_stream_hash / windows), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1553.005, evaluated against their create_stream_hash events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names three knobs on this analytic. WatchedExtensions is the first — adjust the monitored container types to match what actually moves through your environment; the nine listed here are the pipeline's own selection, not MITRE's. TrustedExtractionTools would let a real deployment allowlist known enterprise archivers and imaging tools to cut the IT-provisioning noise, but nothing in this brief carries the extraction-tool identity as an observable field, so it isn't applied here. TimeWindow names the correlation window between extraction and first execution — irrelevant to this rule specifically, since it only covers the tagging event, not the join MITRE originally described.

Declared by the author

IT and software-deployment downloads of ISO or VHD images for provisioning and imaging, such as OS media pulled by MDT, SCCM or a hypervisor's own image library — ordinary administrative work and the loudest source of matches here.
Browsers and mail clients downloading legitimate archived software, drivers or installers packaged as .zip, .rar or .7z from a vendor site, which receive the identical Zone.Identifier stream as a malicious archive.
Cloud storage and file-sync clients that write the Internet zone marker onto archives synchronised from a shared folder, independent of any user download action.

Lessondefense evasion subvert trust

defense evasion subvert trustAI draft — unreviewed

01 · What this rule detects

MITRE's analytic AN0712 wants a three-way correlation: a container file (ISO, VHD, ZIP, and similar) arriving from the Internet, its contents failing to inherit the Zone.Identifier Mark-of-the-Web tag once extracted or mounted, and an untrusted binary executing from inside it. Sigma has no operator to hold a three-event join together, and this brief carries no process_creation logsource at all, so the execution leg is unreachable from a single rule regardless of what the analytic asks for. What the rule actually matches is the precursor step: the moment the container file itself gets tagged with the Internet zone — the precondition without which the bypass has nothing to exploit.

02 · Telemetry you need

Sysmon EventID 15 (create_stream_hash), which fires when a named alternate data stream — specifically Zone.Identifier — is written to a file. This event is not emitted by a bare Sysmon install, and most shipped configs, including the common SwiftOnSecurity baseline, restrict stream hashing to a short extension list that excludes archive and disk-image types entirely. Confirm MITRE's WatchedExtensions knob is actually configured to cover .iso, .zip, .7z and the rest before trusting silence from this rule.

03 · How the logic works

A single selection block requires both conditions. TargetFilename must end with one of nine container extensions suffixed :Zone.Identifier — .iso, .img, .vhd, .vhdx, .zip, .rar, .7z, .gz, .arj — and Contents must contain ZoneId=3, the literal Internet zone value, so Intranet, Trusted, and Restricted zone tags are excluded on purpose. That zone-3 filter is deliberate: it narrows the rule to files that actually crossed the Internet boundary rather than any locally-built or intranet-sourced container.

04 · Common false positives

The rule's own description is blunt about scope: it fires identically whether the extracted contents ever fail to inherit MOTW or not, since that absence is not something Sigma can observe. A hit here means "an archive arrived from the Internet," not "MOTW was bypassed" — treat it as a lead to manually check extracted contents, never as confirmation of the technique. Three named false-positive sources: IT and deployment tooling pulling ISO or VHD images for provisioning (MDT, SCCM, hypervisor image libraries — the loudest source by far), browsers and mail clients downloading legitimate vendor archives, and cloud storage or file-sync clients that stamp the Internet zone onto synced archives independent of any user download action. Level is set to low to match that volume.

05 · Detection maturity

tier_1: This rule sits at the lowest DeBMM tier: authored from MITRE's prose, never run against a log line, and only a partial cover of the analytic it derives from at that. It stays there until it has fired against real Sysmon EID15 telemetry and someone has checked whether its hits correlate with genuine MOTW-bypass activity, not just routine archive downloads.

Related detections2 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/be41f99a-b438-4b87-8a92-6a36eb516405

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Zone.Identifier stream stamped onto a container or disk image file

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it