Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

Title: Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
Status: test
Description:Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"
References:
  -https://twitter.com/pfiatde/status/1681977680688738305
  -https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
  -https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
  -https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
  -https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
Author: Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)
Date: 2023-10-09
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1564.004'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    CommandLine|contains: '::$index_allocation'
  condition:selection
Falsepositives:
  -Unlikely
Level: medium