NTFS Alternate Data Stream (8c521530-5169-495d-a199-0a3a881ad24e)

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	NTFS Alternate Data Stream (8c521530-5169-495d-a199-0a3a881ad24e)	Sigma-Rules	1
NTFS Alternate Data Stream (8c521530-5169-495d-a199-0a3a881ad24e)	Sigma-Rules	NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8)	Attack Pattern	2