Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream
Alerts on Windows file events creating hidden NTFS content using the '::$index_allocation' alternate stream.
- Product
- windows
- Category
- file_event
- Author
- Scoubi (@ScoubiMtl) (SigmaHQ), DRL 1.1
- Published
- 2023-10-09
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file events where the target filename contains the NTFS "$::index_allocation" stream marker, indicating creation of hidden file or folder content via the $INDEX_ALLOCATION alternate stream technique. Attackers may use this to make items less visible to common tools and scripts, supporting stealth objectives. It relies on Windows file event telemetry that records the full target filename including stream identifiers.
Reporting behind it
- twitter.comhttps://twitter.com/pfiatde/status/1681977680688738305
- soroush.mehttps://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
- sec-consult.comhttps://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream
id: 5f9bb9f1-54a0-429e-8e2c-21eccb21c41a
related:
- id: 0900463c-b33b-49a8-be1d-552a3b553dae
type: similar
- id: a8f866e1-bdd4-425e-a27a-37619238d9c7
type: derived
status: test
description: This rule flags file events where the target filename contains the NTFS "$::index_allocation" stream marker, indicating creation of hidden file or folder content via the $INDEX_ALLOCATION alternate stream technique. Attackers may use this to make items less visible to common tools and scripts, supporting stealth objectives. It relies on Windows file event telemetry that records the full target filename including stream identifiers.
references:
- https://twitter.com/pfiatde/status/1681977680688738305
- https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
- https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
- https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml
author: Scoubi (@ScoubiMtl), Huntrule Team
date: 2023-10-09
tags:
- attack.stealth
- attack.t1564.004
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: ::$index_allocation
condition: selection
falsepositives:
- Unlikely
level: medium
license: DRL-1.1