tfMITRE ATT&CK sub-technique

NTFS File Attributes T1564.004

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 13 March 2020
Last modified: 12 May 2026
Contributors: Oddvar Moe, @oddvarmoe; Red Canary

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. [1] Within MFT entries are file attributes, [2] such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). [1] [3] [4] [5]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 21%

Tools & malware79th percentile · 79% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 10%

Detection rules90th percentile · 90% of ATT&CK techniques have this many detection rules written or fewer.

NTFS File Attributes MITRE reference T1564.004

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT32G0050 ↗

Used NTFS alternate data streams to hide their payloads.1

created 2017-12-141 referenceaka SeaLotus

All 1 groups for this technique

15 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LatrodectusS1160 ↗

Can delete itself while its process is still running through the use of an alternate data stream.1

created 2024-09-16MALWAREcarried by 2 groups

DEADEYES1052 ↗

The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.1

created 2022-12-20MALWARE

WastedLockerS0612 ↗

Has the ability to save and execute files as an alternate data stream (ADS).1

created 2021-05-20MALWAREcarried by 1 group

BitPaymerS0570 ↗

Has copied itself to the :bin alternate data stream of a newly created file.1

created 2021-02-08MALWAREcarried by 1 group

AnchorS0504 ↗

Has used NTFS to hide files.1

created 2020-09-10MALWAREcarried by 1 group

ValakS0476 ↗

Has the ability save and execute files as alternate data streams (ADS).1 2 3

created 2020-06-19MALWAREcarried by 1 group

All 15 software entries for this technique · 6 newest in this preview

Offense vs defense T1564.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 23Splunk ESCU (cumulative) · 6

first rule: 2018 Q2

NTFS File Attributes detection strategy DET0432

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for NTFS File Attribute Abuse (ADS/EAs)

Enterprise

1 platform

AN1206 · Windows

Suspicious use of NTFS file attributes such as Alternate Data Streams (ADS) or Extended Attributes (EA) to hide data. Defender perspective: anomalous file creations or modifications containing colon syntax (file.ext:ads), API calls like ZwSetEaFile/ZwQueryEaFile, or PowerShell/Windows utilities interacting with -stream parameters. Correlation across file metadata anomalies, process lineage, and command execution provides context.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-File	ZwSetEaFile or ZwQueryEaFile function calls
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ADSPathWhitelist	Exclude legitimate ADS usage by system or AV tools.
ProcessScope	Restrict monitoring to suspicious parent processes (e.g., powershell.exe, cmd.exe, wscript.exe).
TimeWindow	Correlate ADS creation with subsequent process execution to strengthen malicious context.

2 analytics

NTFS Alternate Data Streams (ADSs) may be used by adversaries as a means of evading security tools by storing malicious data or binaries in file attribute metadata. ADSs are also powerful because they can be directly executed by various Windows tools; accordingly, this analytic looks at common ways of executing ADSs using system utilities such as powershell.

TypeTTPCoverageLowSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is generic pseudocode that lines up with the below Splunk queries.

processes = search Process:Create
ads_processes = filter processes where (
exe == "powershell.exe OR rundll32.exe OR wmic.exe OR wscript.exe OR cscript.exe" and command_line.matches("__some_regex__")
)
output ads_processes

This Splunk query looks for invocations of powershell used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 Image=C:\\Windows\\*\\powershell.exe|regex CommandLine="Invoke-CimMethod\s+-ClassName\s+Win32_Process\s+-MethodName\s+Create.*\b(\w+(\.\w+)?):(\w+(\.\w+)?)|-ep bypass\s+-\s+<.*\b(\w+(\.\w+)?):(\w+(\.\w+)?)|-command.*Get-Content.*-Stream.*Set-Content.*start-process .*(\w+(\.\w+)?)"

This Splunk query looks for invocations of WMIC used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 Image=C:\\Windows\\*\\wmic.exe | regex CommandLine="process call create.*\"(\w+(\.\w+)?):(\w+(\.\w+)?)"

This Splunk query looks for invocations of rundll32 used to execute NTFS alternate data streams.

index=__sysmon_index__  EventCode=1 Image=C:\\Windows\\*\\rundll32.exe | regex CommandLine="\"?(\w+(\.\w+)?):(\w+(\.\w+)?)?\"?,\w+\|(advpack\.dll\|ieadvpack\.dll),RegisterOCX\s+(\w+\.\w+):(\w+(\.\w+)?)\|(shdocvw\.dll\|ieframe\.dll),OpenURL.*(\w+\.\w+):(\w+(\.\w+)?)"

This Splunk query looks for invocations of the windows scripting host used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\*\\wscript.exe OR Image=C:\\Windows\\*\\cscript.exe) | regex CommandLine="(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$"

NTFS Alternate Data Streams (ADSs) may be used by adversaries as a means of evading security tools by storing malicious data or binaries in file attribute metadata. ADSs are also powerful because their contents can be directly executed by various Windows tools; accordingly, this analytic looks at common ways of executing ADSs using Living off the Land Binaries and Scripts (LOLBAS).

TypeTTPCoverageLowSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is generic pseudocode that lines up with the below Splunk queries.

processes = search Process:Create
ads_processes = filter processes where (
exe == "control.exe OR appvlp.exe OR cmd.exe OR ftp.exe OR bash.exe OR mavinject.exe OR bitsadmin.exe" and command_line.matches("__some_regex__")
)
output ads_processes

This Splunk query looks for invocations of control.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\System32\\control.exe OR Image=C:\\Windows\SysWOW64\\control.exe) | regex CommandLine="(\w+(\.\w+)?):(\w+\.dll)"

This Splunk query looks for invocations of appvlp.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image="C:\\Program Files\\Microsoft Office\\root\\Client\\AppVLP.exe" OR Image="C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\AppVLP.exe") | regex CommandLine="(\w+(\.\w+)?):(\w+(\.\w+)?)"

This Splunk query looks for invocations of cmd.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\cmd.exe OR Image=C:\\Windows\\SysWOW64\\cmd.exe) | regex CommandLine="-\s+<.*\b(\w+(\.\w+)?):(\w+(\.\w+)?)"

This Splunk query looks for invocations of ftp.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\ftp.exe OR Image=C:\\Windows\\SysWOW64\\ftp.exe) | regex CommandLine="-s:(\w+(\.\w+)?):(\w+(\.\w+)?)"

This Splunk query looks for invocations of bash.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\bash.exe OR C:\\Windows\\SysWOW64\\bash.exe) | regex CommandLine="-c.*(\w+(\.\w+)?):(\w+(\.\w+)?)"

This Splunk query looks for invocations of mavinject.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\mavinject.exe OR C:\\Windows\\SysWOW64\\mavinject.exe) | regex CommandLine="\d+\s+\/INJECTRUNNING.*\b(\w+(\.\w+)?):(\w+(\.\w+)?)"

This Splunk query looks for invocations of bitsadmin.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\bitsadmin.exe OR C:\\Windows\\SysWOW64\\bitsadmin.exe) | regex CommandLine="\/create.*\/addfile.*\/SetNotifyCmdLine.*\b(\w+\.\w+):(\w+(\.\w+)?)"

Tests5Executorscmd 3 · PowerShell 2Need elevation1 of 5Have prerequisites1Have cleanup4Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Alternate Data Streams (ADS)

windows

cmd

Required

—

Execute from Alternate Streams Reference - 1 Reference - 2

Input arguments

Name	Type	Default	Description
path	path	c:\ADS\	Path of ADS file

Attack command

type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
extrac32 #{path}\procexp.cab #{path}\file.txt:procexp.exe
findstr /V /L W3AllLov3DonaldTrump #{path}\procexp.exe > #{path}\file.txt:procexp.exe
certutil.exe -urlcache -split -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1564.004/src/test.ps1 c:\temp:ttt
makecab #{path}\autoruns.exe #{path}\cabtest.txt:autoruns.cab
print /D:#{path}\file.txt:autoruns.exe #{path}\Autoruns.exe
reg export HKLM\SOFTWARE\Microsoft\Evilreg #{path}\file.txt:evilreg.reg
regedit /E #{path}\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
expand \\webdav\folder\file.bat #{path}\file.txt:file.bat
esentutl.exe /y #{path}\autoruns.exe /d #{path}\file.txt:autoruns.exe /o

GUID1afb6e8b-8c61-42ee-b98d-8f6229b779d9

Store file in Alternate Data Stream (ADS)

windows

PowerShell

—

Yes

Storing files in Alternate Data Stream (ADS) similar to Astaroth malware. Upon execution, cmd will run and attempt to launch desktop.ini. No windows remain open after the test

Input arguments

Name	Type	Default	Description
ads_name	string	desktop.ini	Name of ADS
payload_path	path	c:\windows\system32\cmd.exe	Path of file to hide in ADS
ads_file_path	path	C:\Users\Public\Libraries\yanki\desktop.ini	Path of file to create an ADS under

Attack command

if (!(Test-Path C:\Users\Public\Libraries\yanki -PathType Container)) {
    New-Item -ItemType Directory -Force -Path C:\Users\Public\Libraries\yanki
    }
Start-Process -FilePath "$env:comspec" -ArgumentList "/c,type,#{payload_path},>,`"#{ads_file_path}:#{ads_name}`""

Cleanup command

Remove-Item "#{ads_file_path}" -Force -ErrorAction Ignore

GUID8f9a4077-f8a6-4779-8d20-a4d62182fe0e

Create ADS command prompt

windows

cmd

—

Yes

Create an Alternate Data Stream with the command prompt. Write access is required. Upon execution, run "dir /a-d /s /r | find ":$DATA"" in the %temp% folder to view that the alternate data stream exists. To view the data in the alternate data stream, run "notepad T1564.004_has_ads.txt:adstest.txt"

Input arguments

Name	Type	Default	Description
file_name	string	%temp%\T1564.004_has_ads_cmd.txt	File name of file to create ADS on.
ads_filename	string	adstest.txt	Name of ADS.

Attack command

echo cmd /c echo "Shell code execution."> #{file_name}:#{ads_filename}
for /f "usebackq delims=?" %i in (#{file_name}:#{ads_filename}) do %i

Cleanup command

del #{file_name} >nul 2>&1

GUIDac1680d8-30c1-43c1-8bef-ef9aec530c86

Create ADS PowerShell

windows

PowerShell

—

Yes

Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, run the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname" in the %temp% directory to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.

Input arguments

Name	Type	Default	Description
file_name	string	$env:TEMP\T1564.004_has_ads_powershell.txt	File name of file to create ADS on.
ads_filename	string	adstest.txt	Name of ADS file.

Attack command

echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test"
set-content -path #{file_name} -stream #{ads_filename} -value "test2"
set-content -path . -stream #{ads_filename} -value "test3"

Cleanup command

Remove-Item -Path #{file_name} -ErrorAction Ignore

Prerequisite

The file must exist on disk at specified location (#{file_name})

Check

if (Test-Path #{file_name}) { exit 0 } else { exit 1 }

Satisfy

New-Item -Path #{file_name} | Out-Null

GUID94745512-97a8-4916-ae97-6c616de691c3

Create Hidden Directory via $index_allocation

windows

cmd

—

Yes

Create an Alternate Data Stream Directory and File with the command prompt. Write access is required. Upon execution, run "dir /A /Q /R" in the %temp% folder to view that the alternate data stream folder exists. To view the data in the alternate data stream, run "type %temp%\...$.......::$index_allocation\secrets.txt"

Input arguments

Name	Type	Default	Description
folder_name	string	%temp%\...$.......::$index_allocation	File name of file to create inside the folder.
hidden_filename	string	secrets.txt	Name of the files containing the hidden information

Attack command

md #{folder_name}
echo too many secrets > #{folder_name}\#{hidden_filename}

Cleanup command

rmdir /S /Q #{folder_name} >nul 2>&1

GUID79f2ee41-4da9-45f4-8c68-37201f20e386

Tests from Atomic Red Team (MIT licence) · technique definition

NTFS File Attributes detections T1564.004

29 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 10%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs