Sysmon Event ID 15 — File stream created — SecOps Tools

Why event 15 matters

ADS used to hide payloads in legitimate files (T1564.004). Data stored in ADS is not visible to standard directory listing. Malware stored in Zone.Identifier ADS (which marks internet-downloaded files) or custom named streams. PowerShell payloads stored as ADS.

How to detect it

Alert: ADS creation outside of Zone.Identifier (normal Windows behavior for downloaded files). Alert: ADS with executable content (.exe, .ps1, .dll) attached to non-executable files.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Defense Evasion	Hide Artifacts: NTFS File Attributes (T1564.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule

title: Suspicious Alternate Data Stream Created
status: experimental
description: ADS created — possible payload hiding via NTFS streams
author: theadminstack.com
date: 2026/05/16
logsource:
    category: file_event
    product: windows
detection:
    selection:
        EventID: 15
        TargetFilename|contains: ':'
    filter_zone:
        TargetFilename|endswith: ':Zone.Identifier'
    condition: selection and not filter_zone
falsepositives:
    - Some legitimate software using ADS
level: medium
tags:
    - attack.defense_evasion
    - attack.t1564.004

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 15   // File stream created
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=15
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# File stream created — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 15 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 15?

File stream created. An Alternate Data Stream (ADS) was created. TargetFilename and Hash are key.

Which log records event 15?

Event 15 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 15?

Event 15 is associated with: Hide Artifacts: NTFS File Attributes (T1564.004).

How do you detect activity around event 15?

Alert: ADS creation outside of Zone.Identifier (normal Windows behavior for downloaded files). Alert: ADS with executable content (.exe, .ps1, .dll) attached to non-executable files.