Zone identifier stream naming a locally assembled download source

Siemphony@siemphonymediumT1027.006unverified

AN0872 points at Sysmon EventID 15 and the Zone.Identifier stream a browser or mail client stamps onto a file it delivered, and specifically at the HostUrl and ReferrerUrl values recorded inside it. A file fetched over the network carries the server it came from; a file that HTML smuggling assembled inside the page from a JavaScript Blob or a Data URL never crossed the network as a file, so the browser has no source to record and writes about:internet, about:blank, or the blob: or data: URL itself. This rule pairs that origin marker with MITRE's DroppedFileExtensionWatchlist knob, populated here with the executable, script, shortcut, installer and container types a smuggled payload arrives as, because the marker alone also appears on every client-side export a web application generates. The drop-then-execute half of the analytic — the dropped file running a few minutes after the HTML was opened — is a correlation Sigma cannot express and is not attempted, and a payload written to a path Sysmon is not watching produces no event at all. Two configuration prerequisites: EventID 15 is not emitted by a bare Sysmon install and most shipped configurations restrict stream hashing to a short extension list, and the Contents field carrying the URL values exists only on Sysmon 13.10 and later, so on an older agent this rule parses cleanly and can never fire. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0313, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((TargetFilename="*.exe:Zone.Identifier" OR TargetFilename="*.dll:Zone.Identifier" OR TargetFilename="*.msi:Zone.Identifier" OR TargetFilename="*.scr:Zone.Identifier" OR TargetFilename="*.pif:Zone.Identifier" OR TargetFilename="*.hta:Zone.Identifier" OR TargetFilename="*.js:Zone.Identifier" OR TargetFilename="*.jse:Zone.Identifier" OR TargetFilename="*.vbs:Zone.Identifier" OR TargetFilename="*.vbe:Zone.Identifier" OR TargetFilename="*.wsf:Zone.Identifier" OR TargetFilename="*.ps1:Zone.Identifier" OR TargetFilename="*.bat:Zone.Identifier" OR TargetFilename="*.cmd:Zone.Identifier" OR TargetFilename="*.lnk:Zone.Identifier" OR TargetFilename="*.iso:Zone.Identifier" OR TargetFilename="*.img:Zone.Identifier" OR TargetFilename="*.vhd:Zone.Identifier" OR TargetFilename="*.vhdx:Zone.Identifier" OR TargetFilename="*.zip:Zone.Identifier" OR TargetFilename="*.rar:Zone.Identifier" OR TargetFilename="*.7z:Zone.Identifier") AND (Contents="*HostUrl=about:internet*" OR Contents="*HostUrl=about:blank*" OR Contents="*HostUrl=blob:*" OR Contents="*HostUrl=data:*" OR Contents="*ReferrerUrl=blob:*" OR Contents="*ReferrerUrl=data:*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*.exe:zone.identifier" OR TO_LOWER(file.path) LIKE "*.dll:zone.identifier" OR TO_LOWER(file.path) LIKE "*.msi:zone.identifier" OR TO_LOWER(file.path) LIKE "*.scr:zone.identifier" OR TO_LOWER(file.path) LIKE "*.pif:zone.identifier" OR TO_LOWER(file.path) LIKE "*.hta:zone.identifier" OR TO_LOWER(file.path) LIKE "*.js:zone.identifier" OR TO_LOWER(file.path) LIKE "*.jse:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vbs:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vbe:zone.identifier" OR TO_LOWER(file.path) LIKE "*.wsf:zone.identifier" OR TO_LOWER(file.path) LIKE "*.ps1:zone.identifier" OR TO_LOWER(file.path) LIKE "*.bat:zone.identifier" OR TO_LOWER(file.path) LIKE "*.cmd:zone.identifier" OR TO_LOWER(file.path) LIKE "*.lnk:zone.identifier" OR TO_LOWER(file.path) LIKE "*.iso:zone.identifier" OR TO_LOWER(file.path) LIKE "*.img:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vhd:zone.identifier" OR TO_LOWER(file.path) LIKE "*.vhdx:zone.identifier" OR TO_LOWER(file.path) LIKE "*.zip:zone.identifier" OR TO_LOWER(file.path) LIKE "*.rar:zone.identifier" OR TO_LOWER(file.path) LIKE "*.7z:zone.identifier") AND (TO_LOWER(Contents) LIKE "*hosturl=about:internet*" OR TO_LOWER(Contents) LIKE "*hosturl=about:blank*" OR TO_LOWER(Contents) LIKE "*hosturl=blob:*" OR TO_LOWER(Contents) LIKE "*hosturl=data:*" OR TO_LOWER(Contents) LIKE "*referrerurl=blob:*" OR TO_LOWER(Contents) LIKE "*referrerurl=data:*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,create_stream_hash,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\.exe:Zone\.Identifier$|\.dll:Zone\.Identifier$|\.msi:Zone\.Identifier$|\.scr:Zone\.Identifier$|\.pif:Zone\.Identifier$|\.hta:Zone\.Identifier$|\.js:Zone\.Identifier$|\.jse:Zone\.Identifier$|\.vbs:Zone\.Identifier$|\.vbe:Zone\.Identifier$|\.wsf:Zone\.Identifier$|\.ps1:Zone\.Identifier$|\.bat:Zone\.Identifier$|\.cmd:Zone\.Identifier$|\.lnk:Zone\.Identifier$|\.iso:Zone\.Identifier$|\.img:Zone\.Identifier$|\.vhd:Zone\.Identifier$|\.vhdx:Zone\.Identifier$|\.zip:Zone\.Identifier$|\.rar:Zone\.Identifier$|\.7z:Zone\.Identifier$)</field>    <field name="Contents" type="pcre2">(?i)(HostUrl=about:internet|HostUrl=about:blank|HostUrl=blob:|HostUrl=data:|ReferrerUrl=blob:|ReferrerUrl=data:)</field>    <description>Zone identifier stream naming a locally assembled download source</description>    <mitre>      <id>T1027.006</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"create_stream_hash","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: create_stream_hash / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 40bb1b65-b5ea-43df-bfee-28782cf1fa24

ATT&CKT1027.006

T1027.006HTML Smuggling

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

A Sysmon EventID 15 event where a file with a payload-shaped extension receives a Zone.Identifier stream whose recorded origin is not a server. HTML smuggling assembles the file inside the page from a JavaScript Blob or a Data URL, so nothing crossed the network as a file and the browser has no host to stamp.

02 · Telemetry you need

EventID 15 is off in a bare Sysmon install, and most shipped configurations
Contents — the field carrying HostUrl and ReferrerUrl — exists only on Sysmon
The reviewer added a third: only Chromium-family browsers and Windows

03 · How the logic works

Two selections, AND-ed together. selection_zone_stream matches TargetFilename|endswith against twenty-two literals of the form '.exe:Zone.Identifier' — the alternate-data-stream naming convention, extension then stream name. It covers executables, scripts, shortcuts, installers and the container types (.iso, .img, .vhd, .zip) a smuggled payload arrives inside. That list is MITRE's DroppedFileExtensionWatchlist knob, populated here by the author; MITRE named the knob and offered three examples. selection_local_origin matches Contents|contains against six markers: HostUrl=about:internet, HostUrl=about:blank, HostUrl=blob:, HostUrl=data: and the ReferrerUrl forms of the last two. This is the discriminator — a file fetched over HTTP records its actual server here. Deliberately absent: MITRE's TimeWindow and the drop-then-execute correlation. Sigma has no timeframe, so the rule stops at the drop.

04 · Common false positives

The loudest match is the same mechanism used benignly. Reporting consoles, admin portals and password managers package files client-side with a Blob and the HTML5 download attribute — identical marker, identical extensions. Download managers and browser extensions that hand finished bytes to the page do the same. Mail and chat clients saving an attachment apply the internet zone with no HTTP source of their own, which puts every saved .zip and .iso on the list. Phishing-simulation platforms deliver genuine samples on purpose.
The reviewer named one more: software-distribution consoles handing a downloaded .msi or .exe to the browser as a Blob — routine IT, top of the extension list. level: medium is what that first entry supports.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. UNVERIFIED — derived from DET0313, never executed against a log line. Nobody has confirmed the six origin markers are the strings your Sysmon build actually writes.
tier_2: needs a week of EventID 15 with Contents populated, ranked by writing process, to learn which internal applications generate Blob downloads.
tier_3: restores the correlation MITRE asked for — the dropped file executing inside the TimeWindow — which is a streaming join, not a Sigma rule.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Re-populate the extension list from your own delivery telemetry. It is the half
Exclude your internal portals by the process writing the stream, not by
Deploy this alongside the corpus's T1204.002 rule as one alert, not two —
The cheap bypass is not obfuscation. Serve the payload from a throwaway HTTPS

Declared by the author

Web applications that build a download in the browser instead of serving it, where a reporting console, an admin portal or a password manager packages files into a .zip client-side with a JavaScript Blob and the HTML5 download attribute. That is the same mechanism the technique abuses and produces the same origin marker, so it is the loudest benign match here and the reason the level is not higher.
Browser extensions and download managers that hand finished bytes to the page rather than letting the browser fetch the URL, so a saved installer or archive is written with no originating host recorded.
Mail, chat and collaboration clients saving an attachment to disk, which apply the internet zone without any HTTP source of their own; an .iso or .zip attachment saved out of a webmail session matches on the extension list for exactly that reason.
Phishing simulation platforms, security awareness training and detection validation suites that deliver a genuine HTML smuggling sample on purpose, producing a real match for every user who opens the exercise.

Noise checknot tested

No baseline event covers this rule’s log type (create_stream_hash / windows), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.006, evaluated against their create_stream_hash events.

Share this rule

/u/siemphony/40bb1b65-b5ea-43df-bfee-28782cf1fa24

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Zone identifier stream naming a locally assembled download source

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it