Techniques › T1564.004 › AN1206
AN1206 Analytic 1206
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Suspicious use of NTFS file attributes such as Alternate Data Streams (ADS) or Extended Attributes (EA) to hide data. Defender perspective: anomalous file creations or modifications containing colon syntax (file.ext:ads), API calls like ZwSetEaFile/ZwQueryEaFile, or PowerShell/Windows utilities interacting with -stream parameters. Correlation across file metadata anomalies, process lineage, and command execution provides context.</p>
- Detects
- T1564.004 NTFS File Attributes
- Part of
- DET0432 Detection Strategy for NTFS File Attribute Abuse (ADS/EAs)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=15 | DC0059 File Metadata |
| etw:Microsoft-Windows-Kernel-File | ZwSetEaFile or ZwQueryEaFile function calls | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ADSPathWhitelist | Exclude legitimate ADS usage by system or AV tools. |
ProcessScope | Restrict monitoring to suspicious parent processes (e.g., powershell.exe, cmd.exe, wscript.exe). |
TimeWindow | Correlate ADS creation with subsequent process execution to strengthen malicious context. |