Skip to content
Threat Feed
Subscribe

Tag

Ntfs

4 briefs RSS
high advisory

PowerShell Script Execution from Alternate Data Streams

Detection of attackers using NTFS Alternate Data Streams (ADS) to hide and execute malicious PowerShell scripts, effectively bypassing simple file-based scanning.

stealth execution persistence powershell ntfs
1r 1t
medium advisory

Abuse of NTFS INDEX_ALLOCATION Stream for Directory Obfuscation

Attackers can abuse the NTFS $INDEX_ALLOCATION stream to create directories that are inaccessible to standard Windows utilities like Explorer and PowerShell, facilitating stealthy data storage.

stealth persistence windows ntfs
1r 1t
medium advisory

Execution via NTFS Alternate Data Streams

Adversaries utilize NTFS Alternate Data Streams to hide and execute malicious payloads, evading detection by conventional file analysis tools.

stealth persistence ads ntfs windows
1r 1t
medium advisory

Detection of PowerShell Alternate Data Stream File Storage

Adversaries utilize PowerShell to store malicious payloads within NTFS Alternate Data Streams (ADS) to evade detection and maintain stealthy persistence.

persistence stealth powershell ntfs
1r 1t