Possible Hidden Directory Creation Through NTFS INDEX_ALLOCATION Stream - CLI (via process_creation)

title: Possible Hidden Directory Creation Through NTFS INDEX_ALLOCATION Stream - CLI (via process_creation)
id: 4976e830-6ea5-5f49-933c-a093238fc94d
status: stable
description: This rule detects command line containing reference to the "::$index_allocation" stream, that can be used as a method to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"
references:
    - https://attack.mitre.org/techniques/T1564/004/
    - https://twitter.com/pfiatde/status/1681977680688738305
    - https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
    - https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
    - https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
author: Huntrule Team
date: 2026-03-07
tags:
    - attack.stealth
    - attack.t1564.004
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains: '::$index_allocation'
    condition: selection
falsepositives:
    - Unknown
level: medium