Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream

title: "Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream"
id: 0c5e53a1-eb3e-423f-858f-b48fcb000a46
related:
  - id: a8f866e1-bdd4-425e-a27a-37619238d9c7
    type: similar
  - id: 0900463c-b33b-49a8-be1d-552a3b553dae
    type: derived
status: test
description: This rule flags Windows process creation events where the CommandLine contains a reference to the NTFS "::$index_allocation" stream. Attackers may use this stream to hide files or folders from common access and tooling, increasing stealth. Telemetry relies on process creation logging with a captured CommandLine and matches only on the presence of the "::$index_allocation" substring.
references:
  - https://twitter.com/pfiatde/status/1681977680688738305
  - https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
  - https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
  - https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml
author: Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl), Huntrule Team
date: 2023-10-09
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains: ::$index_allocation
  condition: selection
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1