Windows PowerShell Script Execution from Alternate Data Stream (ADS)

Flags PowerShell processes using Get-Content -Stream to execute or retrieve script content from an ADS.

FreeUnreviewedSigmahighv1

windows-powershell-script-execution-from-alternate-data-stream-ads-45a594aa

title: Windows PowerShell Script Execution from Alternate Data Stream (ADS)
id: ef0d809a-ca6f-4bfd-b849-0928de437f12
status: test
description: This rule identifies cases where PowerShell (powershell.exe or pwsh.exe) reads script content using Alternate Data Streams by matching a command line containing Get-Content with the -Stream parameter. Attackers can use ADS to hide or deliver executable or script content without storing it as a standalone file, increasing stealth. The detection relies on Windows process creation telemetry, specifically process image paths and the full PowerShell command line.
references:
  - https://github.com/p0shkatz/Get-ADS/blob/1c3a3562e713c254edce1995a7d9879c687c7473/Get-ADS.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_run_script_from_ads.yml
author: Sergey Soldatov, Kaspersky Lab, oscd.community, Huntrule Team
date: 2019-10-30
modified: 2022-07-14
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains|all:
      - Get-Content
      - -Stream
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 45a594aa-1fbd-4972-a809-ff5a99dd81b8
    type: derived

What it detects

This rule identifies cases where PowerShell (powershell.exe or pwsh.exe) reads script content using Alternate Data Streams by matching a command line containing Get-Content with the -Stream parameter. Attackers can use ADS to hide or deliver executable or script content without storing it as a standalone file, increasing stealth. The detection relies on Windows process creation telemetry, specifically process image paths and the full PowerShell command line.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.