SOC Event Lookup
Event ID 15FileP3

Sysmon Event ID 15: FileCreateStreamHash

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 15 records creation of a named file stream and hashes stream content.

Technical Metadata

Technical metadata for Event ID 15
Event ID15
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0005 Defense Evasion / T1564.004 Hide Artifacts: NTFS File Attributes
Key fields to watchTargetFilename, Hash / Contents, Image / ProcessGuid

Trigger Scenarios

Microsoft documents that this event logs when a named file stream is created and records hashes of the unnamed file contents and the named stream, with Zone.Identifier as a common mark-of-the-web stream.

Key Fields

TargetFilename

The file and stream path. A colon suffix such as file.txt:payload.exe indicates an NTFS alternate data stream.

Hash / Contents

Sysmon records hashes of stream content, which should be used to preserve and triage the hidden payload.

Image / ProcessGuid

The process that created the stream and the join key to Event ID 1 command-line context.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 15
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 15
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 15
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=15
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 15
dataset = microsoft_windows_raw
| filter edr_event_id = 15
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 15
title: Sysmon Event ID 15
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 15
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID15A named file stream was created and its content was hashed.Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source
TargetFilename:Zone.IdentifierThe browser Mark-of-the-Web alternate data stream documented by Sysinternals.Interpret TargetFilename with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1564.004Hide Artifacts: NTFS File Attributes

Detection Notes

Alert when TargetFilename contains an ADS suffix such as C:\Users\Public\invoice.txt:payload.exe or a non-Zone.Identifier stream under Downloads, Temp, or ProgramData. Microsoft documents Event 15 for named file streams and Zone.Identifier; MITRE T1564.004 covers Alternate Data Streams used to hide data. Correlate ProcessGuid to Event 1 and preserve the stream hash before deleting the host artifact.

Common False Positives

  • Browsers create Zone.Identifier streams on downloaded files.
  • Backup and endpoint tools may inspect or create metadata streams during scanning.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 03:03:00.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
TargetFilename: C:\Users\Public\invoice.txt:payload.exe
Hashes: SHA256=REDACTED
ProcessGuid: {REDACTED}

Frequently Asked Questions

What does Sysmon Event ID 15 mean?

A named file stream was created and Sysmon recorded hashes and stream content.

Does Event ID 15 always indicate malicious activity?

No. Browsers routinely create Zone.Identifier streams on downloaded files.

How should Event ID 15 be investigated?

Distinguish Zone.Identifier from unusual stream names and correlate ProcessGuid with file creation and process execution.

Sources

Machine-readable JSON