Windows PowerShell Script Execution from Alternate Data Stream (ADS)
Flags PowerShell processes using Get-Content -Stream to execute or retrieve script content from an ADS.
- Product
- windows
- Category
- process_creation
- Author
- Sergey Soldatov, Kaspersky Lab, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-30
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies cases where PowerShell (powershell.exe or pwsh.exe) reads script content using Alternate Data Streams by matching a command line containing Get-Content with the -Stream parameter. Attackers can use ADS to hide or deliver executable or script content without storing it as a standalone file, increasing stealth. The detection relies on Windows process creation telemetry, specifically process image paths and the full PowerShell command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Script Execution from Alternate Data Stream (ADS)
id: ef0d809a-ca6f-4bfd-b849-0928de437f12
status: test
description: This rule identifies cases where PowerShell (powershell.exe or pwsh.exe) reads script content using Alternate Data Streams by matching a command line containing Get-Content with the -Stream parameter. Attackers can use ADS to hide or deliver executable or script content without storing it as a standalone file, increasing stealth. The detection relies on Windows process creation telemetry, specifically process image paths and the full PowerShell command line.
references:
- https://github.com/p0shkatz/Get-ADS/blob/1c3a3562e713c254edce1995a7d9879c687c7473/Get-ADS.ps1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_run_script_from_ads.yml
author: Sergey Soldatov, Kaspersky Lab, oscd.community, Huntrule Team
date: 2019-10-30
modified: 2022-07-14
tags:
- attack.stealth
- attack.t1564.004
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \powershell.exe
- \pwsh.exe
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains|all:
- Get-Content
- -Stream
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 45a594aa-1fbd-4972-a809-ff5a99dd81b8
type: derived