Alternate data streams removal issue

[ivodelver]

We have deployed the latest version of sysmon 15.15 with the following config "sysmonconfig-with-filedelete.xml"
We experience issues with unblocking downloaded files as the alternate data stream (zone.identifier) fails to remove, i tested this with other files with custom streams, they also fail.

Would this be a configuration issue for sysmon unable to handle a stream as filedelete?

Best regards,
Ivo

[ivodelver]

Alex Burlachenko responded to my question in the sysmon community

So, Sysmon ain’t great with Alternate Data Streams (ADS), like that zone.identifier thing when u unblock downloads. It just doesn’t track ADS deletions well, ‘cause it’s mostly focused on regular files, not the extra streams. If u need to monitor that stuff, u might wanna use a PowerShell script or some other tool to check for changes in the ADS and log it manually. Like, u can make a script that sees if the zone.identifier is gone and then logs it somewhere. Sysmon’s awesome, but it’s kinda dumb with ADS, so u gotta work around it.

would it be possible to alter the filedelete config to exclude ADS?