Detection of Hidden Executables in NTFS Alternate Data Streams

Attackers leverage the NTFS Alternate Data Stream (ADS) feature to store hidden executables within legitimate files. This technique allows malicious payloads to persist on a system without appearing in standard directory listings or being easily detected by basic file integrity monitoring tools. By attaching an executable stream to a host file (e.g., file.txt:malware.exe), an actor can execute the hidden component using Windows binaries like 'wmic' or 'rundll32'. Defenders often overlook ADS content, making it an effective method for staging malware or maintaining persistence in compromised environments. This brief focuses on the detection of such streams by monitoring for the creation of non-null Imphash values associated with ADS file events.

Impact

Successful exploitation allows attackers to execute arbitrary code while obfuscating the malicious binary from standard forensic analysis and basic endpoint detection. This technique is frequently observed in malware staging, lateral movement, and persistent backdoor deployment, complicating incident response and threat hunting efforts.

Recommendation

• Deploy the provided Sigma rule to identify the creation of suspicious streams containing executable content.
• Enable Sysmon Event ID 15 (FileStreamHash) to capture the necessary telemetry for detecting ADS activity.
• Configure security tools to alert on non-standard stream creation events originating from non-installer processes.
• Investigate occurrences of hidden streams to differentiate between legitimate software packaging and malicious staging activity.