Run PowerShell Script from ADS

Title: Run PowerShell Script from ADS
Status: test
Description:Detects PowerShell script execution from Alternate Data Stream (ADS)
References:
  -https://github.com/p0shkatz/Get-ADS/blob/1c3a3562e713c254edce1995a7d9879c687c7473/Get-ADS.ps1
Author: Sergey Soldatov, Kaspersky Lab, oscd.community
Date: 2019-10-30
modified:2022-07-14
Tags:

• -'attack.stealth'
• -'attack.t1564.004'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith:
      -'\powershell.exe'
      -'\pwsh.exe'

    Image|endswith:
      -'\powershell.exe'
      -'\pwsh.exe'

    CommandLine|contains|all:
      -'Get-Content'
      -'-Stream'

  condition:selection
Falsepositives:
  -Unknown
Level: high