Skip to content
Threat Feed
Subscribe

Tag

Ads

4 briefs RSS
medium advisory

Execution via NTFS Alternate Data Streams

Adversaries utilize NTFS Alternate Data Streams to hide and execute malicious payloads, evading detection by conventional file analysis tools.

stealth persistence ads ntfs windows
1r 1t
medium advisory

Detection of Hidden Executables in NTFS Alternate Data Streams

Adversaries utilize NTFS Alternate Data Streams (ADS) to conceal malicious executables, effectively bypassing basic file visibility checks and traditional security scans.

stealth persistence ads
1r 1t
medium threat

ShieldBreak Local Privilege Escalation via NTFS Alternate Data Streams

The ShieldBreak exploit abuses symbolic link swaps over local loopback SMB shares to create NTFS Alternate Data Streams, enabling privilege escalation by redirecting privileged file writes to system-critical directories.

exploited Windows shieldbreak rogueplanet privilege-escalation ads
1r 2t
high advisory

Rundll32 Execution with DLL Stored in Alternate Data Stream (ADS)

Adversaries may use rundll32.exe to execute DLLs stored within alternate data streams (ADS) to bypass security controls and conceal malicious code.

defense-evasion ads rundll32 windows
2r 1t