PowerShell writes to NTFS Alternate Data Streams via -Stream with Set/Add-Content

title: PowerShell writes to NTFS Alternate Data Streams via -Stream with Set/Add-Content
id: c3150474-e6e3-45c4-aa7b-7b38201931fa
status: test
description: This rule flags PowerShell script blocks that write data using NTFS Alternate Data Streams by combining Set-Content or Add-Content with the -Stream parameter. Adversaries can use Alternate Data Streams to hide or stage content while keeping it associated with a seemingly legitimate file. The detection relies on PowerShell script block telemetry capturing ScriptBlockText for both the cmdlet usage and the -Stream argument.
references:
  - https://web.archive.org/web/20220614030603/http://www.powertheshell.com/ntfsstreams/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml
author: Sami Ruohonen, Huntrule Team
date: 2018-07-24
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1564.004
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_content:
    ScriptBlockText|contains:
      - set-content
      - add-content
  selection_stream:
    ScriptBlockText|contains: -stream
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8c521530-5169-495d-a199-0a3a881ad24e
    type: derived