Sysmon Event ID 15: FileCreateStreamHash
Sysmon Event ID 15 records creation of a named file stream and hashes stream content.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that this event logs when a named file stream is created and records hashes of the unnamed file contents and the named stream, with Zone.Identifier as a common mark-of-the-web stream.
Key Fields
TargetFilename
The file and stream path. A colon suffix such as file.txt:payload.exe indicates an NTFS alternate data stream.
Hash / Contents
Sysmon records hashes of stream content, which should be used to preserve and triage the hidden payload.
Image / ProcessGuid
The process that created the stream and the join key to Event ID 1 command-line context.
Common False Positives
- Browsers create Zone.Identifier streams on downloaded files.
- Backup and endpoint tools may inspect or create metadata streams during scanning.
Related Events
MITRE ATT&CK Mapping
- T1564.004Hide Artifacts: NTFS File Attributes
Detection Notes
Alert when TargetFilename contains an ADS suffix such as C:\Users\Public\invoice.txt:payload.exe or a non-Zone.Identifier stream under Downloads, Temp, or ProgramData. Microsoft documents Event 15 for named file streams and Zone.Identifier; MITRE T1564.004 covers Alternate Data Streams used to hide data. Correlate ProcessGuid to Event 1 and preserve the stream hash before deleting the host artifact.
Sysmon
| where EventID == 15
| where TargetFilename contains ":"
| project TimeGenerated, Computer, Image, TargetFilename, Hashes, ProcessGuidindex=sysmon EventCode=15 TargetFilename="*:*" | table _time, host, Image, TargetFilename, Hashes, ProcessGuidUtcTime: 2026-07-13 03:03:00.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
TargetFilename: C:\Users\Public\invoice.txt:payload.exe
Hashes: SHA256=REDACTED
ProcessGuid: {REDACTED}