Artifact Analysis: NTFS Alternate Data Streams (ADS)

Note

Executive Summary: Alternate Data Streams (ADS) are a native feature of the NTFS file system designed to allow files to contain multiple streams of data without affecting their primary size or functionality. While legitimately used by Windows to track downloaded file origins (Mark of the Web), ADS serves as a powerful defense evasion technique for threat actors. By hiding malicious payloads, scripts, or exfiltrated data within the alternate streams of legitimate files, attackers can bypass basic file system scans, visual inspections, and legacy antivirus engines.

1. Technical Mechanics of ADS

To understand ADS, analysts must look at how the New Technology File System (NTFS) manages data. Every file on an NTFS volume consists of a set of attributes stored within a Master File Table (MFT) record.

The actual content of a file is stored in the $DATA attribute. A standard file has a single, unnamed $DATA attribute. However, NTFS allows a single file to have multiple, named $DATA attributes. These are the Alternate Data Streams.

The Naming Convention

An ADS is accessed by appending a colon (:) to the primary file’s name: FileName.extension:StreamName.extension:$DATA

For example, if an attacker hides a payload named malware.exe inside a benign text file named readme.txt, the resulting stream is addressed as: readme.txt:malware.exe

Crucially, adding a 50MB executable to the ADS of a 1KB text file will not change the reported file size of the text file in Windows Explorer or standard dir commands, making the payload completely invisible to the casual observer.

2. Legitimate Usage: The Zone.Identifier (MoTW)

Before hunting for malware, DFIR analysts must understand the most critical legitimate use of ADS: the Mark of the Web (MoTW).

When a user downloads a file from the internet via a web browser or email client, Windows automatically creates an ADS named Zone.Identifier. This stream contains metadata indicating the file’s origin zone (e.g., Internet, Intranet).

Forensic Value of MoTW

During a Suspicious Email Analysis or phishing investigation, reading the Zone.Identifier stream of a downloaded payload reveals the exact URL from which the file was downloaded (the HostUrl field). This provides immediate, high-fidelity IOCs for threat hunting.

3. Adversarial Exploitation Flow

Threat actors leverage ADS across multiple phases of the kill chain: staging payloads, establishing persistence, and evading detection.

A. Payload Hiding (Staging)

Adversaries often use built-in Windows commands to pipe malicious binaries or scripts into the ADS of legitimate system files or mundane documents.

# Staging a malicious executable inside a standard text file
type evil.exe > C:\Users\Public\readme.txt:hidden.exe

B. Stealth Execution

Writing to an ADS is trivial; executing from it requires specific “Living off the Land” (LOLBAS) techniques. Since modern Windows versions restrict executing an .exe directly from an ADS via the command line, attackers use indirect execution methods.

1. WMI Execution: Using Windows Management Instrumentation to launch the hidden executable. wmic process call create "C:\Users\Public\readme.txt:hidden.exe"
2. Rundll32 Execution: If the hidden payload is a DLL, it can be executed using the native rundll32.exe utility. rundll32.exe C:\Users\Public\readme.txt:hidden.dll,EntryPoint
3. Script Execution: Hiding PowerShell or VBScript code inside an ADS and executing it via Get-Content or wscript.

4. Forensic Investigation (DFIR)

Because ADS payloads are invisible to standard dir or Windows Explorer checks, analysts must use specific utilities during live response or offline MFT parsing.

Live Endpoint Triage

• Command Prompt: The /R flag instructs the dir command to display alternate data streams. dir /R C:\Users\Public\
• PowerShell: Native cmdlets can query and read streams directly. Get-Item -Path C:\Users\Public\readme.txt -Stream * Get-Content -Path C:\Users\Public\readme.txt -Stream hidden.exe

Offline Forensic Analysis

When analyzing a forensic image, analysts parse the $MFT file. Tools like Eric Zimmerman’s MFTECmd will explicitly list files containing named $DATA attributes, allowing analysts to extract the hidden payload directly from the raw disk image regardless of OS restrictions.

5. Detection & Threat Hunting

Detecting ADS abuse requires granular endpoint telemetry. Native Windows event logs are insufficient; organizations must rely on Sysmon or EDR solutions.

Sysmon Event ID 15 (FileCreateStreamHash)

Sysmon Event 15 is specifically designed to log the creation of named file streams. It records the target file, the stream name, and crucially, the cryptographic hash of the stream’s contents, enabling immediate IOC correlation.

KQL (Sysmon EID 15)

hunt_ads_creation.kql

// Detect the creation of executable streams attached to files
DeviceEvents
| where ActionType == "SysmonFileCreateStreamHash"
// Filter out legitimate Zone.Identifier creation
| where TargetFileName !endswith ":Zone.Identifier"
| where TargetFileName !endswith ":SmartScreen"
// Look for streams with executable extensions
| where TargetFileName contains ".exe" or TargetFileName contains ".dll" or TargetFileName contains ".vbs" or TargetFileName contains ".ps1"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, TargetFileName, SHA256
| sort by TimeGenerated desc

Sigma (Execution)

sigma_ads_wmic_execution.yaml

title: Suspicious Execution from Alternate Data Stream via WMIC
id: 3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects the use of wmic.exe to execute a payload hidden within an Alternate Data Stream (ADS).
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'process call create'
            - ':'
    filter_legit:
        CommandLine|contains: ':\\' # Filters out standard drive letters like C:\
    condition: selection and not filter_legit
level: high
tags:
    - attack.defense_evasion
    - attack.t1564.004

6. Mitigation

Disabling Alternate Data Streams is not possible, as it is a fundamental architectural component of the NTFS file system required by legitimate Windows services. Mitigation relies entirely on strict Execution Prevention (blocking execution from unauthorized paths using WDAC/AppLocker) and robust Behavioral Monitoring (EDR/Sysmon) to detect the creation and execution of anomalous streams.

---

Sources & References

• MITRE ATT&CK: Hide Artifacts: NTFS File Attributes (T1564.004)
• Malwarebytes Labs: Introduction to Alternate Data Streams
• Netwrix: Alternate Data Stream Analysis
• MDPI: Analyzing Alternate Data Streams for Forensic Investigations
• Related Artifact: Sysmon (System Monitor) Telemetry