huntrule

Windows Process Creation: Execution CommandLines Involving NTFS Alternate Data Streams

Alerts on Windows executions whose command lines reference NTFS Alternate Data Streams combined with specific file-data tools.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: Execution CommandLines Involving NTFS Alternate Data Streams"
id: c939a12c-df4e-44f2-9f10-9fabaa76cf34
status: test
description: This rule flags Windows process creation events whose command line contains a stream indicator consistent with NTFS Alternate Data Streams (ADS) usage (e.g., the presence of “txt:”). It further narrows matches to common utility execution patterns that can write or retrieve data via files, such as type redirect, makecab, reg export, regedit export, and esentutl operations. Adversaries may use ADS to conceal malicious content within legitimate files and reduce the likelihood of file-based detection, so correlating these command-line patterns is important. Telemetry relied upon is Windows process creation with access to the full CommandLine string.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml
author: frack113, Huntrule Team
date: 2021-09-01
modified: 2022-10-09
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_stream:
    CommandLine|contains: "txt:"
  selection_tools_type:
    CommandLine|contains|all:
      - "type "
      - " > "
  selection_tools_makecab:
    CommandLine|contains|all:
      - "makecab "
      - .cab
  selection_tools_reg:
    CommandLine|contains|all:
      - "reg "
      - " export "
  selection_tools_regedit:
    CommandLine|contains|all:
      - "regedit "
      - " /E "
  selection_tools_esentutl:
    CommandLine|contains|all:
      - "esentutl "
      - " /y "
      - " /d "
      - " /o "
  condition: selection_stream and (1 of selection_tools_*)
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7f43c430-5001-4f8b-aaa9-c3b88f18fa5c
    type: derived

What it detects

This rule flags Windows process creation events whose command line contains a stream indicator consistent with NTFS Alternate Data Streams (ADS) usage (e.g., the presence of “txt:”). It further narrows matches to common utility execution patterns that can write or retrieve data via files, such as type redirect, makecab, reg export, regedit export, and esentutl operations. Adversaries may use ADS to conceal malicious content within legitimate files and reduce the likelihood of file-based detection, so correlating these command-line patterns is important. Telemetry relied upon is Windows process creation with access to the full CommandLine string.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.