Log Dejargonizer

Sysmon · Event 15

Sysmon Event 15: A file was created with an alternate data stream

A file was written along with an alternate data stream — most often the mark of the web, which records that the file came from the internet. It is how you tie a downloaded file to the site it came from, right on the endpoint.

Also written as Sysmon 15Sysmon Event ID 15FileCreateStreamHashmark of the web sysmon

What it means for you

On a personal computer

Only present if you installed Sysmon. It records the hidden note Windows attaches to downloaded files saying where they came from.

For an analyst

The Zone.Identifier stream carries the source URL for files downloaded by browsers and mail clients, which makes this the cheapest endpoint-side way to attribute a payload to its origin. Also catches the older technique of hiding data in alternate streams, which is rare now but trivially detectable here.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
File stream created:
  RuleName: -
  UtcTime: 2026-08-28 09:13:55.610
  ProcessGuid: {a1b2c3d4-0000-0000-0000-0000000012ab}
  ProcessId: 3320
  Image: C:\Program Files\Internet Browser\browser.exe
  TargetFilename: C:\Users\jbrooks\Downloads\invoice.docm
  CreationUtcTime: 2026-08-28 09:13:55.610
  Hash: SHA256=0000000000000000000000000000000000000000000000000000000000000000
  Contents: [ZoneTransfer]\r\nZoneId=3\r\nReferrerUrl=https://example.invalid/\r\nHostUrl=https://files.example.invalid/invoice.docm

The fields that decide it

Everything else in the log line is context.

TargetFilename
The file the stream was attached to.
Contents
The beginning of the stream contents. For Zone.Identifier this includes the ZoneId and often the HostUrl and ReferrerUrl.
  • ZoneId=3Downloaded from the internet. This is the mark of the web.
  • An executable headerData hidden in an alternate stream, which is rarely legitimate.
Image
The process that created the file and stream — usually a browser or mail client.
Hash
The hash of the stream contents.

Ordinary reasons this happens

Most of the time it is one of these.

  • Any file downloaded with a browser, which attaches a Zone.Identifier stream automatically.
  • Email attachments saved to disk.
  • Files copied from a network share or a removable drive.
  • Some applications storing metadata in alternate streams legitimately.

When it is not ordinary

A payload downloaded from the internet.

What gives it awayA Zone.Identifier stream on an executable or script, with a HostUrl pointing somewhere unexpected.

ATT&CK T1105

Data or code hidden in an alternate data stream.

What gives it awayStream contents that look like an executable rather than zone metadata.

ATT&CK T1564.004

Mark of the web deliberately stripped.

What gives it awayNot visible in this event directly — its absence on a downloaded file is the signal, and stripping it is how attackers bypass Office and SmartScreen protections.

ATT&CK T1553.005

What to do next

  1. Read the Contents field for the HostUrl. That is where the file came from.
  2. Check the file extension. Executables and scripts with a mark of the web deserve more attention than documents.
  3. Identify the process that wrote it — browser, mail client, or something else.
  4. Check Sysmon Event 1 for whether the file was subsequently executed.
  5. For non-zone streams, treat contents resembling executable data as a finding.

Queries to run

kql Downloaded executable content with its source URL. Consistently one of the more useful low-volume queries available. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 15 | where TargetFilename matches regex @'\.(exe|dll|ps1|vbs|js|hta|scr|iso|img)$' | project TimeGenerated, Computer, Image, TargetFilename, Contents
kql Alternate data streams that are not mark-of-the-web metadata. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 15 | where Contents !contains 'ZoneId' | project TimeGenerated, Computer, Image, TargetFilename, Contents

Common questions

What is the mark of the web?

An alternate data stream named Zone.Identifier that Windows attaches to files downloaded from the internet, recording which security zone they came from and often the source URL. Office and SmartScreen use it to decide whether to open a file in a restricted mode, which is why attackers try to strip it.

How do I find where a downloaded file came from?

Sysmon Event 15 records the Zone.Identifier stream contents, which include the HostUrl and ReferrerUrl for files downloaded by browsers and mail clients. You can also read it directly on the endpoint with `Get-Content <file> -Stream Zone.Identifier` in PowerShell.

Why do attackers strip the mark of the web?

Because its presence causes Office to open documents in Protected View and causes SmartScreen to warn about executables. Delivering a payload inside an ISO, a VHD, or certain archive formats avoids the marking in the first place, which is why those container formats became popular for delivery.

Read next

Vendor documentation

Last reviewed 28 August 2026