Powershell Store File In Alternate Data Stream (a699b30e-d010-46c8-bbd1-ee2e26765fe9)

Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Powershell Store File In Alternate Data Stream (a699b30e-d010-46c8-bbd1-ee2e26765fe9)	Sigma-Rules	NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	1
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8)	Attack Pattern	2