Detection rules › Sigma
Execute From Alternate Data Streams
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1564.004 Hide Artifacts: NTFS File Attributes |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
| Security-Auditing | 4688 | A new process has been created. |
Stages and Predicates
Stage 1: selection_stream
CommandLine|contains: 'txt:'
Stage 2: 1 of selection_tools_type
CommandLine|contains: ' > '
CommandLine|contains: 'type '
Stage 3: 1 of selection_tools_makecab
CommandLine|contains: .cab
CommandLine|contains: 'makecab '
Stage 4: 1 of selection_tools_reg
CommandLine|contains: ' export '
CommandLine|contains: 'reg '
Stage 5: 1 of selection_tools_regedit
CommandLine|contains: ' /E '
CommandLine|contains: 'regedit '
Stage 6: 1 of selection_tools_esentutl
CommandLine|contains: ' /d '
CommandLine|contains: ' /o '
CommandLine|contains: ' /y '
CommandLine|contains: 'esentutl '
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|