Skip to content

Hide Navigation Hide TOC

Execute From Alternate Data Streams (7f43c430-5001-4f8b-aaa9-c3b88f18fa5c)

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

Cluster A Galaxy A Cluster B Galaxy B Level
Execute From Alternate Data Streams (7f43c430-5001-4f8b-aaa9-c3b88f18fa5c) Sigma-Rules NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5) Attack Pattern 1
Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5) Attack Pattern 2