{"id":"T1564.004","name":"NTFS File Attributes","url":"https://attack.mitre.org/techniques/T1564/004","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0432","stix_id":"x-mitre-detection-strategy--08f7fa2b-13f3-4348-83b8-023c2a68493f","name":"Detection Strategy for NTFS File Attribute Abuse (ADS/EAs)","url":"https://attack.mitre.org/detectionstrategies/DET0432","analytics":[{"id":"AN1206","stix_id":"x-mitre-analytic--dba3fe8d-6080-4efe-9b93-6eda138ac771","name":"Analytic 1206","description":"Suspicious use of NTFS file attributes such as Alternate Data Streams (ADS) or Extended Attributes (EA) to hide data. Defender perspective: anomalous file creations or modifications containing colon syntax (file.ext:ads), API calls like ZwSetEaFile/ZwQueryEaFile, or PowerShell/Windows utilities interacting with -stream parameters. Correlation across file metadata anomalies, process lineage, and command execution provides context.","url":"https://attack.mitre.org/detectionstrategies/DET0432#AN1206","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=15","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-sysmon"},{"name":"etw:Microsoft-Windows-Kernel-File","channel":"ZwSetEaFile or ZwQueryEaFile function calls","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-microsoft-windows-kernel-file"}],"mutable_elements":[{"field":"ADSPathWhitelist","description":"Exclude legitimate ADS usage by system or AV tools."},{"field":"ProcessScope","description":"Restrict monitoring to suspicious parent processes (e.g., powershell.exe, cmd.exe, wscript.exe)."},{"field":"TimeWindow","description":"Correlate ADS creation with subsequent process execution to strengthen malicious context."}],"live":true,"detection_strategies":["DET0432"],"techniques":["T1564.004"]}],"live":true,"version":"1.0","techniques":["T1564.004"]}],"sigma_rules":[{"id":"025bd229-fd1f-4fdb-97ab-20006e1a5368","title":"Unusual File Download from Direct IP Address","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-07","modified":"2023-02-10","description":"Detects the download of suspicious file type from URLs with IP","references":["https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md","https://labs.withsecure.com/publications/detecting-onenote-abuse"],"logsource":{"product":"windows","category":"create_stream_hash"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml","techniques":["T1564.004"],"cves":[]},{"id":"04936b66-3915-43ad-a8e5-809eadfd1141","title":"Insensitive Subfolder Search Via Findstr.EXE","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2020-10-05","modified":"2024-03-05","description":"Detects execution of findstr with the \"s\" and \"i\" flags for a \"subfolder\" and \"insensitive\" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Findstr/","https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"0900463c-b33b-49a8-be1d-552a3b553dae","title":"Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI","author":"Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)","status":"test","level":"medium","date":"2023-10-09","modified":null,"description":"Detects command line containing reference to the \"::$index_allocation\" stream, which can be used as a technique to prevent access to folders or files from tooling such as \"explorer.exe\" or \"powershell.exe\"\n","references":["https://twitter.com/pfiatde/status/1681977680688738305","https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/","https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/","https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation","https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml","techniques":["T1564.004"],"cves":[]},{"id":"0d7a9363-af70-4e7b-a3b7-1a176b7fbe84","title":"Exports Registry Key To an Alternate Data Stream","author":"Oddvar Moe, Sander Wiebing, oscd.community","status":"test","level":"high","date":"2020-10-07","modified":"2021-11-27","description":"Exports the target Registry key and hides it in the specified alternate data stream.","references":["https://lolbas-project.github.io/lolbas/Binaries/Regedit/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"create_stream_hash"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml","techniques":["T1564.004"],"cves":[]},{"id":"19b041f6-e583-40dc-b842-d6fa8011493f","title":"HackTool Named File Stream Created","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-24","modified":"2024-11-23","description":"Detects the creation of a named file stream with the imphash of a well-known hack tool","references":["https://github.com/gentilkiwi/mimikatz","https://github.com/topotam/PetitPotam","https://github.com/ohpe/juicy-potato","https://github.com/antonioCoco/RoguePotato","https://www.tarasco.org/security/pwdump_7/","https://github.com/fortra/nanodump","https://github.com/codewhitesec/HandleKatz","https://github.com/xuanxuan0/DripLoader","https://github.com/hfiref0x/UACME","https://github.com/outflanknl/Dumpert","https://github.com/wavestone-cdt/EDRSandblast"],"logsource":{"product":"windows","category":"create_stream_hash"},"tags":["attack.stealth","attack.s0139","attack.t1564.004"],"path":"rules/windows/create_stream_hash/create_stream_hash_hktl_generic_download.yml","techniques":["T1564.004"],"cves":[]},{"id":"349d891d-fef0-4fe4-bc53-eee623a15969","title":"Use Short Name Path in Command Line","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-08-07","modified":"2025-10-22","description":"Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations.\nWindows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs.\nWhen investigating, examine:\n- Commands using short paths to access sensitive directories or files\n- Web servers on Windows (especially Apache) where short filenames could bypass security controls\n- Correlation with other suspicious behaviors\n- baseline of short name usage in your environment and look for deviations\n","references":["https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)","https://twitter.com/frack113/status/1555830623633375232"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml","techniques":["T1564.004"],"cves":[]},{"id":"3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe","title":"Hidden Flag Set On File/Directory Via Chflags - MacOS","author":"Omar Khaled (@beacon_exe)","status":"test","level":"medium","date":"2024-08-21","modified":null,"description":"Detects the execution of the \"chflags\" utility with the \"hidden\" flag, in order to hide files on MacOS.\nWhen a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.\n","references":["https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/","https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/","https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf","https://ss64.com/mac/chflags.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b","title":"Use NTFS Short Name in Image","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-06","modified":"2023-07-20","description":"Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection","references":["https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)","https://twitter.com/jonasLyk/status/1555914501802921984"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml","techniques":["T1564.004"],"cves":[]},{"id":"45a594aa-1fbd-4972-a809-ff5a99dd81b8","title":"Run PowerShell Script from ADS","author":"Sergey Soldatov, Kaspersky Lab, oscd.community","status":"test","level":"high","date":"2019-10-30","modified":"2022-07-14","description":"Detects PowerShell script execution from Alternate Data Stream (ADS)","references":["https://github.com/p0shkatz/Get-ADS/blob/1c3a3562e713c254edce1995a7d9879c687c7473/Get-ADS.ps1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_powershell_run_script_from_ads.yml","techniques":["T1564.004"],"cves":[]},{"id":"4b13db67-0c45-40f1-aba8-66a1a7198a1e","title":"Suspicious Extrac32 Alternate Data Stream Execution","author":"frack113","status":"test","level":"medium","date":"2021-11-26","modified":"2022-12-30","description":"Extract data from cab file and hide it in an alternate data stream","references":["https://lolbas-project.github.io/lolbas/Binaries/Extrac32/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml","techniques":["T1564.004"],"cves":[]},{"id":"52182dfb-afb7-41db-b4bc-5336cb29b464","title":"Suspicious File Download From File Sharing Websites -  File Stream","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-24","modified":"2026-03-29","description":"Detects the download of suspicious file type from a well-known file and paste sharing domain","references":["https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015","https://www.cisa.gov/uscert/ncas/alerts/aa22-321a","https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/","https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/"],"logsource":{"product":"windows","category":"create_stream_hash"},"tags":["attack.stealth","attack.s0139","attack.t1564.004"],"path":"rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_susp_extension.yml","techniques":["T1564.004"],"cves":[]},{"id":"587254ee-a24b-4335-b3cd-065c0f1f4baa","title":"Remote File Download Via Findstr.EXE","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-10-05","modified":"2024-03-05","description":"Detects execution of \"findstr\" with specific flags and a remote share path. This specific set of CLI flags would allow \"findstr\" to download the content of the file located on the remote share as described in the LOLBAS entry.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Findstr/","https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_findstr_download.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"6b369ced-4b1d-48f1-b427-fdc0de0790bd","title":"Suspicious Diantz Alternate Data Stream Execution","author":"frack113","status":"test","level":"medium","date":"2021-11-26","modified":"2022-12-31","description":"Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.","references":["https://lolbas-project.github.io/lolbas/Binaries/Diantz/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml","techniques":["T1564.004"],"cves":[]},{"id":"7f43c430-5001-4f8b-aaa9-c3b88f18fa5c","title":"Execute From Alternate Data Streams","author":"frack113","status":"test","level":"medium","date":"2021-09-01","modified":"2022-10-09","description":"Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml","techniques":["T1564.004"],"cves":[]},{"id":"8c521530-5169-495d-a199-0a3a881ad24e","title":"NTFS Alternate Data Stream","author":"Sami Ruohonen","status":"test","level":"high","date":"2018-07-24","modified":"2022-12-25","description":"Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.","references":["https://web.archive.org/web/20220614030603/http://www.powertheshell.com/ntfsstreams/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1564.004","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml","techniques":["T1564.004","T1059.001"],"cves":[]},{"id":"9248c7e1-2bf3-4661-a22c-600a8040b446","title":"Potential Rundll32 Execution With DLL Stored In ADS","author":"Harjot Singh, '@cyb3rjy0t'","status":"test","level":"high","date":"2023-01-21","modified":"2026-03-16","description":"Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).","references":["https://lolbas-project.github.io/lolbas/Binaries/Rundll32"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_ads_stored_dll_execution.yml","techniques":["T1564.004"],"cves":[]},{"id":"a699b30e-d010-46c8-bbd1-ee2e26765fe9","title":"Powershell Store File In Alternate Data Stream","author":"frack113","status":"test","level":"medium","date":"2021-09-02","modified":"2022-12-25","description":"Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml","techniques":["T1564.004"],"cves":[]},{"id":"a8f866e1-bdd4-425e-a27a-37619238d9c7","title":"Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream","author":"Scoubi (@ScoubiMtl)","status":"test","level":"medium","date":"2023-10-09","modified":null,"description":"Detects the creation of hidden file/folder with the \"::$index_allocation\" stream. Which can be used as a technique to prevent access to folder and files from tooling such as \"explorer.exe\" and \"powershell.exe\"\n","references":["https://twitter.com/pfiatde/status/1681977680688738305","https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/","https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/","https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation","https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml","techniques":["T1564.004"],"cves":[]},{"id":"a96970af-f126-420d-90e1-d37bf25e50e1","title":"Use Short Name Path in Image","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-08-07","modified":"2025-10-20","description":"Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection","references":["https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)","https://twitter.com/frack113/status/1555830623633375232"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml","techniques":["T1564.004"],"cves":[]},{"id":"ae02ed70-11aa-4a22-b397-c0d0e8f6ea99","title":"Unusual File Download From File Sharing Websites - File Stream","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-08-24","modified":"2026-03-29","description":"Detects the download of suspicious file type from a well-known file and paste sharing domain","references":["https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015","https://www.cisa.gov/uscert/ncas/alerts/aa22-321a","https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/"],"logsource":{"product":"windows","category":"create_stream_hash"},"tags":["attack.stealth","attack.s0139","attack.t1564.004"],"path":"rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_unusual_extension.yml","techniques":["T1564.004"],"cves":[]},{"id":"b69888d4-380c-45ce-9cf9-d9ce46e67821","title":"Hidden Executable In NTFS Alternate Data Stream","author":"Florian Roth (Nextron Systems), @0xrawsec","status":"test","level":"medium","date":"2018-06-03","modified":"2023-02-10","description":"Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash","references":["https://twitter.com/0xrawsec/status/1002478725605273600?s=21"],"logsource":{"product":"windows","category":"create_stream_hash"},"tags":["attack.stealth","attack.s0139","attack.t1564.004"],"path":"rules/windows/create_stream_hash/create_stream_hash_ads_executable.yml","techniques":["T1564.004"],"cves":[]},{"id":"cafeeba3-01da-4ab4-b6c4-a31b1d9730c7","title":"PrintBrm ZIP Creation of Extraction","author":"frack113","status":"test","level":"high","date":"2022-05-02","modified":null,"description":"Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.","references":["https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.stealth","attack.t1105","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml","techniques":["T1105","T1564.004"],"cves":[]},{"id":"dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795","title":"Use NTFS Short Name in Command Line","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-05","modified":"2022-09-21","description":"Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection","references":["https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)","https://twitter.com/jonasLyk/status/1555914501802921984"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.004"],"path":"rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml","techniques":["T1564.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}