Windows Process Creation: Execution CommandLines Involving NTFS Alternate Data Streams
Alerts on Windows executions whose command lines reference NTFS Alternate Data Streams combined with specific file-data tools.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-09-01
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events whose command line contains a stream indicator consistent with NTFS Alternate Data Streams (ADS) usage (e.g., the presence of “txt:”). It further narrows matches to common utility execution patterns that can write or retrieve data via files, such as type redirect, makecab, reg export, regedit export, and esentutl operations. Adversaries may use ADS to conceal malicious content within legitimate files and reduce the likelihood of file-based detection, so correlating these command-line patterns is important. Telemetry relied upon is Windows process creation with access to the full CommandLine string.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Execution CommandLines Involving NTFS Alternate Data Streams"
id: c939a12c-df4e-44f2-9f10-9fabaa76cf34
status: test
description: This rule flags Windows process creation events whose command line contains a stream indicator consistent with NTFS Alternate Data Streams (ADS) usage (e.g., the presence of “txt:”). It further narrows matches to common utility execution patterns that can write or retrieve data via files, such as type redirect, makecab, reg export, regedit export, and esentutl operations. Adversaries may use ADS to conceal malicious content within legitimate files and reduce the likelihood of file-based detection, so correlating these command-line patterns is important. Telemetry relied upon is Windows process creation with access to the full CommandLine string.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml
author: frack113, Huntrule Team
date: 2021-09-01
modified: 2022-10-09
tags:
- attack.stealth
- attack.t1564.004
logsource:
category: process_creation
product: windows
detection:
selection_stream:
CommandLine|contains: "txt:"
selection_tools_type:
CommandLine|contains|all:
- "type "
- " > "
selection_tools_makecab:
CommandLine|contains|all:
- "makecab "
- .cab
selection_tools_reg:
CommandLine|contains|all:
- "reg "
- " export "
selection_tools_regedit:
CommandLine|contains|all:
- "regedit "
- " /E "
selection_tools_esentutl:
CommandLine|contains|all:
- "esentutl "
- " /y "
- " /d "
- " /o "
condition: selection_stream and (1 of selection_tools_*)
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 7f43c430-5001-4f8b-aaa9-c3b88f18fa5c
type: derived