NTFS Alternate Data Stream

Title: NTFS Alternate Data Stream
Status: test
Description:Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
References:
  -https://web.archive.org/web/20220614030603/http://www.powertheshell.com/ntfsstreams/
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
Author: Sami Ruohonen
Date: 2018-07-24
modified:2022-12-25
Tags:

• -'attack.stealth'
• -'attack.t1564.004'
• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_content:
    ScriptBlockText|contains:
      -'set-content'
      -'add-content'

  selection_stream:
    ScriptBlockText|contains: '-stream'
  condition:all of selection*
Falsepositives:
  -Unknown
Level: high