Possible Hidden Directory Creation Through NTFS INDEX_ALLOCATION Stream (via file_event)

title: Possible Hidden Directory Creation Through NTFS INDEX_ALLOCATION Stream (via file_event)
id: 7b2e7c89-d003-56fd-96b8-c13d744ce760
status: stable
description: This rule detects the creation of hidden file/folder with the "::$index_allocation" stream. That can be used as a method to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"
references:
    - https://attack.mitre.org/techniques/T1564/004/
    - https://twitter.com/pfiatde/status/1681977680688738305
    - https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
    - https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
    - https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
author: Huntrule Team
date: 2026-06-29
tags:
    - attack.stealth
    - attack.t1564.004
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '::$index_allocation'
    condition: selection
falsepositives:
    - Unknown
level: medium