attack.t1564.004

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·

Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Sep 2, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Suspicious File Download From File Sharing Websites - File Stream

Aug 23, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Unusual File Download From File Sharing Websites - File Stream

Aug 23, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the download of suspicious file type from a well-known file and paste sharing domain

Hidden Flag Set On File/Directory Via Chflags - MacOS

Aug 21, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Execute From Alternate Data Streams

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

Exports Registry Key To an Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Exports the target Registry key and hides it in the specified alternate data stream.

HackTool Named File Stream Created

Aug 12, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the creation of a named file stream with the imphash of a well-known hack tool

Hidden Executable In NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.s0139 attack.t1564.004 ·

Share on:

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

Insensitive Subfolder Search Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

NTFS Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 attack.execution attack.t1059.001 ·

Share on:

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

Potential Rundll32 Execution With DLL Stored In ADS

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).

Powershell Store File In Alternate Data Stream

Aug 12, 2024 · attack.defense-evasion attack.t1564.004 ·

Share on:

Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.

PrintBrm ZIP Creation of Extraction

Aug 12, 2024 · attack.command-and-control attack.t1105 attack.defense-evasion attack.t1564.004 ·

Share on:

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Remote File Download Via Findstr.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.