Suspicious Alternate Data Stream (ADS) File Creation

This detection identifies suspicious creation of Alternate Data Streams (ADS) on files with targeted extensions (e.g., .exe, .dll, .pdf, .docx) on Windows systems. Attackers leverage ADS to conceal malicious payloads within otherwise benign files, making them harder to detect using traditional methods. The activity is triggered when a script interpreter like cmd.exe or powershell.exe is used to create an ADS. This detection is particularly relevant because it focuses on a defense evasion technique used to bypass standard security controls, and ADS creation on common file types is unusual in legitimate scenarios.

Attack Chain

1. The attacker gains initial access to the target system (e.g., via phishing or exploitation).
2. The attacker uses a command interpreter such as cmd.exe or powershell.exe to create an ADS on a target file.
3. The ADS is created using redirection operators (e.g., > or >>) to write data into the alternate stream.
4. The attacker writes malicious code or data into the created ADS. This code might be an executable, a script, or configuration data for malware.
5. The attacker executes code within the ADS using a method that is specific to the type of payload and the attacker's goals, such as powershell -c "Get-Content C:\path\to\file.exe -stream hidden | Invoke-Expression".
6. The malicious code performs actions such as downloading additional payloads, establishing persistence, or exfiltrating data.
7. The attacker may repeat steps 2-6 to compromise additional systems or achieve further objectives.

Impact

A successful ADS attack can lead to a wide range of impacts, including malware infection, data theft, and system compromise. The hidden nature of ADS makes detection difficult, allowing attackers to maintain a persistent presence on the compromised system. Depending on the attacker's goals, this could result in significant financial loss, reputational damage, or disruption of operations.

Recommendation

• Deploy the Sigma rule Detect Suspicious ADS File Creation to your SIEM and tune for your environment.
• Enable Sysmon file creation logging to capture events related to ADS creation, which is essential for the Sigma rule Detect Suspicious ADS File Creation.
• Investigate any alerts generated by the Sigma rule and analyze the contents of the ADS to determine if it contains malicious code or data.
• Consider implementing additional security controls to prevent the creation of ADS on sensitive files, such as access control lists (ACLs).
• Monitor process execution chains for suspicious processes that create ADS, particularly those originating from web browsers or email clients.