Skip to content

Hide Navigation Hide TOC

Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI (0900463c-b33b-49a8-be1d-552a3b553dae)

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

Cluster A Galaxy A Cluster B Galaxy B Level
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI (0900463c-b33b-49a8-be1d-552a3b553dae) Sigma-Rules NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5) Attack Pattern 1
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5) Attack Pattern Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern 2