NTFS Alternate Data Stream
Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
Sigma rule (View on GitHub)
1title: NTFS Alternate Data Stream
2id: 8c521530-5169-495d-a199-0a3a881ad24e
3status: test
4description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
5references:
6 - http://www.powertheshell.com/ntfsstreams/
7 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
8author: Sami Ruohonen
9date: 2018/07/24
10modified: 2022/12/25
11tags:
12 - attack.defense_evasion
13 - attack.t1564.004
14 - attack.execution
15 - attack.t1059.001
16logsource:
17 product: windows
18 category: ps_script
19 definition: 'Requirements: Script Block Logging must be enabled'
20detection:
21 selection_content:
22 ScriptBlockText|contains:
23 - set-content
24 - add-content
25 selection_stream:
26 ScriptBlockText|contains: '-stream'
27 condition: all of selection*
28falsepositives:
29 - Unknown
30level: high
References
-
powertheshell.com is your first and best source for all of the information you’re looking for. From general topics to more of what you would expect to find here, powertheshell.com has it all. We hope you find what you are searching for!
Read More -
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More
Related rules
- Potential PowerShell Downgrade Attack
- PowerShell -encodedcommand Switch
- Base64 Encoding in CMD or Powershell
- PowerShell Base64 Encoding
- PowerShell Create Local User