T1564.004Stealth
NTFS File Attributes
Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
23 Sigma rules tagged T1564.004NTFS File AttributesT1564.00423 general rules
- Exports Registry Key To an Alternate Data Streamhightest
- HackTool Named File Stream Createdhightest
- NTFS Alternate Data Streamhightest
- Potential Rundll32 Execution With DLL Stored In ADShightest
- PrintBrm ZIP Creation of Extractionhightest
- Run PowerShell Script from ADShightest
- Suspicious File Download From File Sharing Websites - File Streamhightest
- Unusual File Download from Direct IP Addresshightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to NTFS File Attributes
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.