Internet zone marker written onto a high-risk file type

Siemphony@siemphonymediumT1204.002unverified

AN0819 begins with a delivered file landing in a user-controlled path, and the one event that records that delivery rather than inferring it is Sysmon EventID 15, written when a handler stamps the Zone.Identifier alternate data stream onto a file it pulled from outside; this rule matches that stream on the file types that need a user to open them, which is MITRE's SuspiciousExtensions knob populated here with the script, shortcut, control-panel, disk-image and macro-document extensions the technique lists. The later leg of the analytic — the handler application spawning a system utility — is deliberately not written, because the corpus already carries exactly that logic under the parent technique T1204 and a second copy of the document-parent-spawns-LOLBin rule would add no coverage. Plain .exe and .msi are excluded for a different reason: a downloaded installer is the highest-volume zone-stream event on any estate and would bury every other match. EventID 15 is not emitted by a bare Sysmon install and most shipped configurations restrict stream hashing to a short extension list, so confirm these extensions are in the running config first — otherwise the rule is blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0294, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (TargetFilename="*.hta:Zone.Identifier" OR TargetFilename="*.lnk:Zone.Identifier" OR TargetFilename="*.js:Zone.Identifier" OR TargetFilename="*.jse:Zone.Identifier" OR TargetFilename="*.vbs:Zone.Identifier" OR TargetFilename="*.vbe:Zone.Identifier" OR TargetFilename="*.wsf:Zone.Identifier" OR TargetFilename="*.wsh:Zone.Identifier" OR TargetFilename="*.bat:Zone.Identifier" OR TargetFilename="*.cmd:Zone.Identifier" OR TargetFilename="*.ps1:Zone.Identifier" OR TargetFilename="*.scr:Zone.Identifier" OR TargetFilename="*.pif:Zone.Identifier" OR TargetFilename="*.cpl:Zone.Identifier" OR TargetFilename="*.reg:Zone.Identifier" OR TargetFilename="*.iso:Zone.Identifier" OR TargetFilename="*.img:Zone.Identifier" OR TargetFilename="*.vhd:Zone.Identifier" OR TargetFilename="*.vhdx:Zone.Identifier" OR TargetFilename="*.docm:Zone.Identifier" OR TargetFilename="*.xlsm:Zone.Identifier" OR TargetFilename="*.xll:Zone.Identifier")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(file.path) LIKE "*.hta:zone.identifier" OR TO_LOWER(file.path) LIKE "*.lnk:zone.identifier" OR TO_LOWER(file.path) LIKE "*.js:zone.identifier" OR TO_LOWER(file.path) LIKE "*.jse:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vbs:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vbe:zone.identifier" OR TO_LOWER(file.path) LIKE "*.wsf:zone.identifier" OR TO_LOWER(file.path) LIKE "*.wsh:zone.identifier" OR TO_LOWER(file.path) LIKE "*.bat:zone.identifier" OR TO_LOWER(file.path) LIKE "*.cmd:zone.identifier" OR TO_LOWER(file.path) LIKE "*.ps1:zone.identifier" OR TO_LOWER(file.path) LIKE "*.scr:zone.identifier" OR TO_LOWER(file.path) LIKE "*.pif:zone.identifier" OR TO_LOWER(file.path) LIKE "*.cpl:zone.identifier" OR TO_LOWER(file.path) LIKE "*.reg:zone.identifier" OR TO_LOWER(file.path) LIKE "*.iso:zone.identifier" OR TO_LOWER(file.path) LIKE "*.img:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vhd:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vhdx:zone.identifier" OR TO_LOWER(file.path) LIKE "*.docm:zone.identifier" OR TO_LOWER(file.path) LIKE "*.xlsm:zone.identifier" OR TO_LOWER(file.path) LIKE "*.xll:zone.identifier")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,create_stream_hash,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\.hta:Zone\.Identifier$|\.lnk:Zone\.Identifier$|\.js:Zone\.Identifier$|\.jse:Zone\.Identifier$|\.vbs:Zone\.Identifier$|\.vbe:Zone\.Identifier$|\.wsf:Zone\.Identifier$|\.wsh:Zone\.Identifier$|\.bat:Zone\.Identifier$|\.cmd:Zone\.Identifier$|\.ps1:Zone\.Identifier$|\.scr:Zone\.Identifier$|\.pif:Zone\.Identifier$|\.cpl:Zone\.Identifier$|\.reg:Zone\.Identifier$|\.iso:Zone\.Identifier$|\.img:Zone\.Identifier$|\.vhd:Zone\.Identifier$|\.vhdx:Zone\.Identifier$|\.docm:Zone\.Identifier$|\.xlsm:Zone\.Identifier$|\.xll:Zone\.Identifier$)</field>    <description>Internet zone marker written onto a high-risk file type</description>    <mitre>      <id>T1204.002</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"create_stream_hash","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: create_stream_hash / windows
Level: medium
Category: office_macro_execution
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 05cade52-d42e-457f-921b-89f6a813b25f

ATT&CKT1204.002

T1204.002Malicious File

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

This rule watches for AN0819's precursor step only: a file handler stamping the Windows Zone.Identifier alternate data stream onto a file it just pulled in from outside the machine — the record that a file arrived from the internet, written before anyone tries to open it. It does not attempt AN0819's second half, the handler application spawning a child process (powershell.exe, wscript.exe, cmd.exe, and similar); that spawn-chain logic already lives under parent technique T1204 in this corpus, so duplicating it here would add no new coverage.

02 · Telemetry you need

Sysmon EventID 15 (create_stream_hash), logsource category create_stream_hash / product windows. Two caveats matter: EventID 15 is not emitted by a bare Sysmon install — it needs stream-hashing config lines that many starter configs cut down or omit — and even shipped configs commonly restrict stream hashing to a short extension list. Confirm your running Sysmon config actually hashes the extensions this rule watches before trusting a "no hits" result, otherwise the rule is blind rather than quiet.

03 · How the logic works

Single selection block: TargetFilename|endswith against 21 literal suffixes, each shaped .<ext>:Zone.Identifier, condition selection. There is no time window and no correlation with process creation — this is a one-shot match on a single log line, not a multi-step detection of "download, then execute." That is a deliberate simplification of AN0819's TimeWindow knob (0-5m in the brief): timing correlation across events isn't attempted, so this rule can only ever confirm delivery, never confirm execution followed it. That is normal for this corpus and worth naming plainly: it is precursor coverage, not full-technique coverage. The 21 suffixes span script hosts (.hta, .js, .jse, .vbs, .vbe, .wsf, .wsh, .bat, .cmd, .ps1), shortcuts and control-panel items (.lnk, .scr, .pif, .cpl, .reg), disk images (.iso, .img, .vhd, .vhdx), and macro-enabled Office types (.docm, .xlsm, .xll). Plain .exe and .msi are deliberately excluded — the description explains a downloaded installer is the single highest-volume zone-stream event on any estate and would bury every other match. That is a real evasion path: deliver the payload as a bare .exe or .msi and this rule never fires on it.

04 · Common false positives

The rule's own falsepositives list is the teaching material here. Loudest: ordinary IT/dev work — a .ps1, .bat, or .cmd pulled from an internal portal or repo through a browser picks up the same zone stream as a malicious one. Close behind: OS, driver, and appliance media (.iso/.img/.vhd) downloaded for routine provisioning, and archive extraction, which propagates the zone marker to every extracted member — one zipped file of shortcuts and batch scripts can fire once per member with no further user action. Cloud-sync clients and sanctioned macro workbooks distributed internally round it out. Given the top entry is the highest-volume script-download traffic on a scripting-heavy estate, level: medium (not high) is the right call here.

05 · Detection maturity

tier_1: Unverified — the lowest tier. This rule was authored from the MITRE brief and has never been run against a single real log line: no false-positive rate, no true-positive confirmation, nothing measured. Treat it as a starting scaffold to pilot against your own Sysmon feed, not a tuned or deployable detection.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names two relevant knobs: SuspiciousExtensions and UserPaths. The 21-value extension list is the rule author's own selection, not MITRE's. Review flagged that the description overstates this, saying "the technique lists" these extensions when MITRE's actual T1204.002 text names only .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso — the script-host, macro, and disk-image entries were assembled to operationalize the knob, not sourced from MITRE. Treat the list as a starting point to prune or extend, not an authoritative MITRE enumeration. UserPaths (Downloads, Temp, Desktop, build/packaging directories) isn't implemented as a filter here at all, since create_stream_hash carries no path-scoping field in this rule — pair it with a downstream check on TargetFilename's directory if you need that narrowing.

Declared by the author

IT and developer downloads of loose scripts. A .ps1, .bat or .cmd file pulled from an internal portal, a vendor support page or a code repository through a browser gets the same zone stream as a malicious one, and on an estate where staff script routinely this is the loudest entry here.
Operating system, driver and appliance media downloaded as .iso, .img or .vhd files during provisioning, which is ordinary IT work and matches on every image fetched.
Archive extraction, which propagates the zone marker to each member: one downloaded .zip containing shortcuts and batch files produces a match per file with no further user action, and MITRE's UserPaths knob is where the extraction directories used by your build and packaging tooling belong.
Cloud storage and file-sync clients writing the zone stream onto files synchronised from a shared folder, and sanctioned macro-enabled workbooks distributed as line-of-business tooling from an intranet site.

Noise checknot tested

No baseline event covers this rule’s log type (create_stream_hash / windows), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1204.002, evaluated against their create_stream_hash events.

Share this rule

/u/siemphony/05cade52-d42e-457f-921b-89f6a813b25f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Internet zone marker written onto a high-risk file type

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it