Ntfs - CraftedSignal Threat Feed

Abuse of NTFS INDEX_ALLOCATION Stream for Directory Obfuscation

hello@craftedsignal.io — Tue, 01 Sep 2026 12:25:07 +0000

This technique involves the abuse of the NTFS filesystem structure, specifically the $INDEX_ALLOCATION attribute. By appending the string "::$INDEX_ALLOCATION" to a directory name during creation, an attacker can create a folder structure that standard Windows APIs and common management tools (such as Windows Explorer or PowerShell) struggle to traverse or list. This effectively hides the directory and its contents from the average user and administrative tools, providing a method for stealthy persistence or data staging. While the data remains accessible via low-level file system calls or specific command-line utilities, this technique is frequently leveraged to bypass automated monitoring and user discovery during the post-exploitation phase. Defenders should be aware that standard EDR process-creation logs may not always capture the full command-line arguments involving alternate data streams, depending on the specific sensor implementation and visibility.

Impact

Successful implementation of this technique results in the creation of hidden directories that effectively bypass traditional file discovery methods. This allows an attacker to conceal malware payloads, exfiltrated data, or persistence mechanisms on an endpoint, reducing the likelihood of detection by security personnel and automated administrative cleanup tasks.

Recommendation

Deploy the provided Sigma rule to detect the use of "::$index_allocation" in command-line arguments.
Verify your EDR/telemetry coverage, as many standard Sysmon configurations do not log alternate data stream path components in process-creation events.
Prioritize auditing file system modifications for directories containing "::$index_allocation" strings.

Execution via NTFS Alternate Data Streams

hello@craftedsignal.io — Tue, 01 Sep 2026 12:24:59 +0000

Adversaries frequently leverage the Windows New Technology File System (NTFS) feature known as Alternate Data Streams (ADS) to conceal malicious code or configuration data. Because ADS allows files to contain multiple data streams, attackers can hide executables or scripts in non-visible streams attached to legitimate files. This technique effectively bypasses many signature-based security products that only scan the primary data stream of a file. By executing code directly from these streams, threat actors maintain persistence and minimize their forensic footprint. Defenders must monitor process creation events that interact with these streams using common Windows administrative utilities that can be repurposed to write or execute data contained within them.

Attack Chain

Attacker gains initial access to the Windows endpoint.
Attacker downloads or stages a malicious payload (e.g., shellcode or script) onto the file system.
Attacker uses a system utility (e.g., 'type') to move the payload into an Alternate Data Stream of a legitimate file (e.g., 'file.txt:malware.exe').
Attacker uses a second utility or a direct execution call (e.g., 'wmic' or 'powershell') to trigger the execution of the payload stored in the stream.
The OS kernel retrieves and executes the data from the specified stream while the file appears benign under standard inspection.
The payload runs in memory or spawns a secondary process to establish C2 communication.
Attacker achieves command execution and potential persistence without creating new suspicious file objects in the standard file list.

Impact

Successful exploitation allows for the execution of arbitrary code with stealth, significantly complicating incident response and forensic analysis. This technique has been observed in various APT campaigns and malware families to bypass endpoint security controls that focus on primary file data, leading to unauthorized access and persistence in targeted environments.

Recommendation

Prioritize the deployment of the provided Sigma rule to detect the creation and access of Alternate Data Streams using standard utilities. Enable Sysmon process-creation logging and focus on command lines that include the colon character (':') to identify suspicious stream interactions. Proactively hunt for process command lines that deviate from standard usage, specifically those using 'type', 'makecab', 'reg', 'regedit', or 'esentutl' in combination with data streams.

Detection of PowerShell Alternate Data Stream File Storage

hello@craftedsignal.io — Tue, 01 Sep 2026 12:18:50 +0000

Adversaries often leverage NTFS Alternate Data Streams (ADS) to conceal malicious scripts or binaries on Windows systems. By storing code in a stream attached to a legitimate file, attackers can bypass traditional signature-based security tools that may only scan the primary data stream. This technique was notably employed by the Astaroth malware to maintain a low profile. Monitoring for PowerShell commands that redirect output into specific file streams using the 'comspec' environment variable is critical for identifying this behavior. Defenders should prioritize visibility into PowerShell Script Block Logging, as this is the primary mechanism for capturing the execution of these stream-redirection commands in a post-exploitation or persistence context.

Attack Chain

Attacker gains initial access to the Windows host via spearphishing or exploit.
PowerShell is invoked to stage a malicious payload on the local filesystem.
Attacker identifies a legitimate host file to serve as a carrier for the ADS payload.
The command sequence is structured using Start-Process, the comspec environment variable, and the redirection operator (>).
The malicious file content is written into the Alternate Data Stream of the target host file (e.g., target.txt:malicious.exe).
Persistence or secondary execution is achieved by invoking the payload directly from the hidden stream.
The primary file remains unchanged, appearing benign to standard file system audits.

Impact

Successful implementation of this technique allows an attacker to hide malicious tools or malware on compromised systems, significantly increasing the difficulty of incident response and forensic analysis. This method facilitates long-term persistence and credential harvesting while avoiding detection by file-integrity monitoring tools that do not specifically account for NTFS streams.

Recommendation

Enable PowerShell Script Block Logging (Event ID 4104) across the environment to capture the full command line of executed scripts.
Deploy the Sigma rule below to detect suspicious redirection patterns targeting ADS.
Audit high-value systems for the presence of unexpected Alternate Data Streams.
Investigate any 'Start-Process' execution that attempts to redirect shell output to unconventional file paths or hidden streams.