NTFS Alternate Data Stream
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
NTFS Alternate Data Stream | Standard | Windows | Execution: Command and Scripting Interpreter - PowerShell (T1059.001), Defense Evasion: Hide Artifacts - NTFS File Attributes (T1564.004) | Critical |
About the rule
Rule Type
Standard
Rule Description
NTFS Alternate Data Streams (ADS) allow files or data to be stored in a hidden stream alongside a legitimate file. While this was originally designed for compatibility with Apple’s HFS, attackers exploit ADS to hide scripts, payloads, or commands without affecting the visible content of a file.
In PowerShell, commands like Set-Content or Add-Content with the -Stream parameter can be used to write hidden data into these alternate streams, making it easy to conceal malicious code during post-exploitation or persistence phases.
Severity
Trouble
Rule journey
Attack chain scenario
Initial access → Execution of PowerShell dropper → Hidden payload written to ADS using Add-Content → Execution of hidden payload via scheduled task → C2 communication established
Impact
- Stealthy file storage
- Defense evasion
- Malware execution
Rule Requirement
Prerequisites
Logon to Group Policy Management Console with administrative privileges and enable Module Logging for Windows PowerShell in the Group Policy Management Editor. Ensure to enter * in the Module Names window to record all modules. Similarly enable PowerShell Script Block Logging for Windows PowerShell. Finally, create a new registry key "Microsoft-Windows-Powershell/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND SCRIPTEXECUTED contains "set-content,add-content" AND SCRIPTEXECUTED contains "-stream" select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Execution: Command and Scripting Interpreter - PowerShell (T1059.001), Defense Evasion: Hide Artifacts - NTFS File Attributes (T1564.004)
Security standard:
Enabling this rule will help you meet the security standard's requirement listed below:
DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.
When this rule is triggered, you're notified of the execution of PowerShell commands like Set-Content or Add-Content along with the -Stream parameter. This enables you to monitor runtime environments like PowerShell.
Author
Sami Ruohonen
Future actions
Known False Positives
This rule might be triggered by legitimate administrative scripts or backup utilities that use ADS for metadata storage or tracking.
Next Steps
When this rule is triggered, the following measures can be implemented:
- Identification: Identify if the flagged event is a new incident or part of an existing incident.
- Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
- Response: Respond promptly by initiating an automated workflow to interrupt the network connections and cease the malicious process.
- Audit PowerShell executions: Enable PowerShell script block logging to monitor command-level activity.
Mitigation
Mitigation ID | Mitigation Name | Mitigation description |
M1022 | Apply the principle of least privilege and restrict access to sensitive files and directories associated with security services. | |
M1049 | Implement antivirus or antimalware scanning to isolate suspicious files. | |
M1045 | Configure policies that allow PowerShell to execute only signed scripts. | |
M1042 | Restrict or disable PowerShell on systems where it is not required. | |
M1038 | Restrict the execution of scripts that contain sensitive language elements i.e., malicious codes using the PowerShell Constrained Language mode. | |
M1026 | Restrict privileges to execute PowerShell scripts to administrators and enforce limitations on the commands that can be executed via remote PowerShell sessions. |
