Alternate Data Stream

Detection of Alternate Data Stream (ADS) creation at a volume root directory, a technique used to hide malware and tools by exploiting how ADSs in root directories are not readily visible to standard system utilities, indicating a defense evasion attempt.

The rule identifies the suspicious creation of Alternate Data Streams (ADS) on targeted files using a script or command interpreter, a technique used by adversaries to hide malicious files and evade detection.

Detection of suspicious creation of Alternate Data Streams (ADS) on targeted files using command interpreters indicates potential malware hiding or defense evasion.

Adversaries may execute malicious code from Alternate Data Streams (ADS) on Windows to evade defenses by hiding malware within legitimate files, which this detection identifies by monitoring process execution paths and arguments.