T1564.004 · NTFS File Attributes

T1564.004 · NTFS File Attributes · Sunturai

attack-patternenterprise-attackT1564.004

NTFS File Attributes

attack-pattern--f2857333-11d4-45bf-b064-2c28d8525be5

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014) Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)

Created: Mar 13, 2020, 8:33 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

31 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Unusual Process Execution Path - Alternate Data Stream	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Unusual File Creation - Alternate Data Stream	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Alternate Data Stream Creation/Execution at Volume Root Directory	Medium	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Windows Wermgr Alternate Data Stream in Temp Dir	Informational	Splunk security content	Aug 26, 2026	Apache-2.0
Windows SymbolicLink-Testing-Tools Utility Execution	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows Alternate DataStream - Process Execution	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows Alternate DataStream - Executable Content	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows Alternate DataStream - Base64 Content	Medium	Splunk security content	Aug 26, 2026	Apache-2.0
Windows Alternate Data Stream Created Over Local Share	Informational	Splunk security content	Aug 26, 2026	Apache-2.0
Use NTFS Short Name in Image	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Use NTFS Short Name in Command Line	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Use Short Name Path in Image	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Execute From Alternate Data Streams	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential Rundll32 Execution With DLL Stored In ADS	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Run PowerShell Script from ADS	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
PrintBrm ZIP Creation of Extraction	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious Extrac32 Alternate Data Stream Execution	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious Diantz Alternate Data Stream Execution	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Insensitive Subfolder Search Via Findstr.EXE	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Remote File Download Via Findstr.EXE	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Powershell Store File In Alternate Data Stream	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
NTFS Alternate Data Stream	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Unusual File Download from Direct IP Address	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 25 of 31

Filter in the catalogue

External references

mitre-attackT1564.004Open reference

MalwareBytes ADS July 2015Open reference

SpectorOps Host-Based Jul 2017Open reference

Journey into IR ZeroAccess NTFS EA

Microsoft NTFS File Attributes Aug 2010Open reference

Microsoft ADS Mar 2014Open reference

Microsoft File StreamsOpen reference

Platforms

Windows

Kill chain phases

stealth

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object