{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/ntfs/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["stealth","persistence","windows","ntfs"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis technique involves the abuse of the NTFS filesystem structure, specifically the $INDEX_ALLOCATION attribute. By appending the string \u0026quot;::$INDEX_ALLOCATION\u0026quot; to a directory name during creation, an attacker can create a folder structure that standard Windows APIs and common management tools (such as Windows Explorer or PowerShell) struggle to traverse or list. This effectively hides the directory and its contents from the average user and administrative tools, providing a method for stealthy persistence or data staging. While the data remains accessible via low-level file system calls or specific command-line utilities, this technique is frequently leveraged to bypass automated monitoring and user discovery during the post-exploitation phase. Defenders should be aware that standard EDR process-creation logs may not always capture the full command-line arguments involving alternate data streams, depending on the specific sensor implementation and visibility.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful implementation of this technique results in the creation of hidden directories that effectively bypass traditional file discovery methods. This allows an attacker to conceal malware payloads, exfiltrated data, or persistence mechanisms on an endpoint, reducing the likelihood of detection by security personnel and automated administrative cleanup tasks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect the use of \u0026quot;::$index_allocation\u0026quot; in command-line arguments.\u003c/li\u003e\n\u003cli\u003eVerify your EDR/telemetry coverage, as many standard Sysmon configurations do not log alternate data stream path components in process-creation events.\u003c/li\u003e\n\u003cli\u003ePrioritize auditing file system modifications for directories containing \u0026quot;::$index_allocation\u0026quot; strings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-01T12:25:07Z","date_published":"2026-09-01T12:25:07Z","id":"https://feed.craftedsignal.io/briefs/2026-09-01-ntfs-index-allocation-hidden-dirs/","summary":"Attackers can abuse the NTFS $INDEX_ALLOCATION stream to create directories that are inaccessible to standard Windows utilities like Explorer and PowerShell, facilitating stealthy data storage.","title":"Abuse of NTFS INDEX_ALLOCATION Stream for Directory Obfuscation","url":"https://feed.craftedsignal.io/briefs/2026-09-01-ntfs-index-allocation-hidden-dirs/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["stealth","persistence","ads","ntfs","windows"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries frequently leverage the Windows New Technology File System (NTFS) feature known as Alternate Data Streams (ADS) to conceal malicious code or configuration data. Because ADS allows files to contain multiple data streams, attackers can hide executables or scripts in non-visible streams attached to legitimate files. This technique effectively bypasses many signature-based security products that only scan the primary data stream of a file. By executing code directly from these streams, threat actors maintain persistence and minimize their forensic footprint. Defenders must monitor process creation events that interact with these streams using common Windows administrative utilities that can be repurposed to write or execute data contained within them.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to the Windows endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker downloads or stages a malicious payload (e.g., shellcode or script) onto the file system.\u003c/li\u003e\n\u003cli\u003eAttacker uses a system utility (e.g., 'type') to move the payload into an Alternate Data Stream of a legitimate file (e.g., 'file.txt:malware.exe').\u003c/li\u003e\n\u003cli\u003eAttacker uses a second utility or a direct execution call (e.g., 'wmic' or 'powershell') to trigger the execution of the payload stored in the stream.\u003c/li\u003e\n\u003cli\u003eThe OS kernel retrieves and executes the data from the specified stream while the file appears benign under standard inspection.\u003c/li\u003e\n\u003cli\u003eThe payload runs in memory or spawns a secondary process to establish C2 communication.\u003c/li\u003e\n\u003cli\u003eAttacker achieves command execution and potential persistence without creating new suspicious file objects in the standard file list.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary code with stealth, significantly complicating incident response and forensic analysis. This technique has been observed in various APT campaigns and malware families to bypass endpoint security controls that focus on primary file data, leading to unauthorized access and persistence in targeted environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the deployment of the provided Sigma rule to detect the creation and access of Alternate Data Streams using standard utilities. Enable Sysmon process-creation logging and focus on command lines that include the colon character (':') to identify suspicious stream interactions. Proactively hunt for process command lines that deviate from standard usage, specifically those using 'type', 'makecab', 'reg', 'regedit', or 'esentutl' in combination with data streams.\u003c/p\u003e\n","date_modified":"2026-09-01T12:24:59Z","date_published":"2026-09-01T12:24:59Z","id":"https://feed.craftedsignal.io/briefs/2026-09-execute-ads/","summary":"Adversaries utilize NTFS Alternate Data Streams to hide and execute malicious payloads, evading detection by conventional file analysis tools.","title":"Execution via NTFS Alternate Data Streams","url":"https://feed.craftedsignal.io/briefs/2026-09-execute-ads/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["persistence","stealth","powershell","ntfs"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries often leverage NTFS Alternate Data Streams (ADS) to conceal malicious scripts or binaries on Windows systems. By storing code in a stream attached to a legitimate file, attackers can bypass traditional signature-based security tools that may only scan the primary data stream. This technique was notably employed by the Astaroth malware to maintain a low profile. Monitoring for PowerShell commands that redirect output into specific file streams using the 'comspec' environment variable is critical for identifying this behavior. Defenders should prioritize visibility into PowerShell Script Block Logging, as this is the primary mechanism for capturing the execution of these stream-redirection commands in a post-exploitation or persistence context.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to the Windows host via spearphishing or exploit.\u003c/li\u003e\n\u003cli\u003ePowerShell is invoked to stage a malicious payload on the local filesystem.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a legitimate host file to serve as a carrier for the ADS payload.\u003c/li\u003e\n\u003cli\u003eThe command sequence is structured using Start-Process, the comspec environment variable, and the redirection operator (\u0026gt;).\u003c/li\u003e\n\u003cli\u003eThe malicious file content is written into the Alternate Data Stream of the target host file (e.g., target.txt:malicious.exe).\u003c/li\u003e\n\u003cli\u003ePersistence or secondary execution is achieved by invoking the payload directly from the hidden stream.\u003c/li\u003e\n\u003cli\u003eThe primary file remains unchanged, appearing benign to standard file system audits.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful implementation of this technique allows an attacker to hide malicious tools or malware on compromised systems, significantly increasing the difficulty of incident response and forensic analysis. This method facilitates long-term persistence and credential harvesting while avoiding detection by file-integrity monitoring tools that do not specifically account for NTFS streams.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PowerShell Script Block Logging (Event ID 4104) across the environment to capture the full command line of executed scripts.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect suspicious redirection patterns targeting ADS.\u003c/li\u003e\n\u003cli\u003eAudit high-value systems for the presence of unexpected Alternate Data Streams.\u003c/li\u003e\n\u003cli\u003eInvestigate any 'Start-Process' execution that attempts to redirect shell output to unconventional file paths or hidden streams.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-01T12:18:50Z","date_published":"2026-09-01T12:18:50Z","id":"https://feed.craftedsignal.io/briefs/2026-09-posh-ads-storage/","summary":"Adversaries utilize PowerShell to store malicious payloads within NTFS Alternate Data Streams (ADS) to evade detection and maintain stealthy persistence.","title":"Detection of PowerShell Alternate Data Stream File Storage","url":"https://feed.craftedsignal.io/briefs/2026-09-posh-ads-storage/"}],"language":"en","title":"CraftedSignal Threat Feed - Ntfs","version":"https://jsonfeed.org/version/1.1"}