Cross-source coverage
T1564.004 / ATT&CK
Hide Artifacts: NTFS File Attributes
30 rules across 3 sources.
2 atomic-IOC hidden · include
From MITRE ATT&CK 19.2
Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).
Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:Sysmonetw:Microsoft-Windows-Kernel-File
How MITRE says to detect it DET0432
Detection Strategy for NTFS File Attribute Abuse (ADS/EAs)
Windows Analytic 1206
Suspicious use of NTFS file attributes such as Alternate Data Streams (ADS) or Extended Attributes (EA) to hide data. Defender perspective: anomalous file creations or modifications containing colon syntax (file.ext:ads), API calls like ZwSetEaFile/ZwQueryEaFile, or PowerShell/Windows utilities interacting with -stream parameters. Correlation across file metadata anomalies, process lineage, and command execution provides context.
WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=15etw:Microsoft-Windows-Kernel-FileZwSetEaFile or ZwQueryEaFile function calls
SigmaHQ/sigma
21 rules| Detection | Severity | Format |
|---|---|---|
| Exports Registry Key To an Alternate Data Stream | High | Sigma |
| NTFS Alternate Data Stream | High | Sigma |
| Potential Rundll32 Execution With DLL Stored In ADS | High | Sigma |
| PrintBrm ZIP Creation of Extraction | High | Sigma |
| Run PowerShell Script from ADS | High | Sigma |
| Suspicious File Download From File Sharing Websites - File Stream | High | Sigma |
| Unusual File Download from Direct IP Address | High | Sigma |
| Execute From Alternate Data Streams | Medium | Sigma |
| Hidden Flag Set On File/Directory Via Chflags - MacOS | Medium | Sigma |
| Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream | Medium | Sigma |
+ 11 more from SigmaHQ/sigma → showing the 10 highest-severity
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Windows Alternate DataStream - Base64 Content | Undefined | SPL |
| Windows Alternate Data Stream Created Over Local Share | Undefined | SPL |
| Windows Alternate DataStream - Executable Content | Undefined | SPL |
| Windows Alternate DataStream - Process Execution | Undefined | SPL |
| Windows SymbolicLink-Testing-Tools Utility Execution | Undefined | SPL |
| Windows Wermgr Alternate Data Stream in Temp Dir | Undefined | SPL |
elastic/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Unusual File Creation - Alternate Data Stream | High | Elastic TOML |
| Alternate Data Stream Creation/Execution at Volume Root Directory | Medium | Elastic TOML |
| Unusual Process Execution Path - Alternate Data Stream | Medium | Elastic TOML |