A file on an NTFS volume is more than its visible contents. It can carry extra data in places most tools never look. NTFS File Attributes (T1564.004) is a Stealth technique for Windows, and a subtechnique of Hide Artifacts.
How attackers use it
MITRE explains that every NTFS partition has a Master File Table (MFT) with a record for every file and directory. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data. When more than one Data attribute is present, the extras are known as Alternate Data Streams (ADS). These attributes can store arbitrary data, even complete files.
Adversaries may store malicious data or binaries in these attributes instead of in the file's main content. MITRE says this can evade defenses such as static indicator scanning tools and antivirus, which look at the main data of a file.
Why it works
Most tools treat a file as one stream of bytes. A file named report.txt can carry a second stream, referred to with a colon and a stream name after the filename. Directory listings show the size of the main stream only, and Explorer does not show the others. So a harmless-looking file can hold data that nobody sees.
Streams are not inherently malicious. Windows itself uses them, for example to record that a file came from the internet. The task is to find streams that do not belong.
How to detect it
MITRE's analytic looks at suspicious use of ADS and EAs, specifically:
- Anomalous file creations or modifications with colon syntax in the name, such as file.ext:streamname.
- API calls such as ZwSetEaFile and ZwQueryEaFile.
- PowerShell or Windows utilities interacting with the stream parameter.
- Correlation of file metadata anomalies, process lineage and command execution for context.
Sysmon helps here. Event ID 15 records the creation of file streams along with a hash, which gives you a record of what went into a stream.
Legitimate streams exist
Alternate Data Streams are an NTFS feature and Windows uses them. The most familiar example is the Zone.Identifier stream, which records that a file was downloaded from another zone, such as the internet. If you list every stream on a system, that one will dominate the results. That is why the command above excludes it. The risk is in streams with other names, especially on files in places such as the user profile folders, temp folders and web roots.
Think about what an adversary gains
MITRE's point is evasion. Static indicator scanning tools and antivirus often examine the main stream of a file. Putting data in another attribute means the visible file is clean and the hidden content is never examined. The data can only be used if something reads it back, so execution still leaves traces in process creation and in file access to the stream. Those are the later steps you can detect even if you miss the hiding.
Detection ideas that work with limited effort
- Collect stream creation events, such as Sysmon event ID 15, and review any with names other than the usual download marker.
- Alert on command lines that use colon syntax in a file name, or the stream option of PowerShell file commands.
- Watch for API use associated with extended attributes, which MITRE names as ZwSetEaFile and ZwQueryEaFile.
- Periodically sweep high-value locations with the stream listing command and diff the results.
Caution on the mitigation
MITRE says to consider adjusting permissions for NTFS extended attributes, but to test. Some operating system functions depend on them, and a change that breaks routine operations will be reverted by someone in a hurry. Pilot on a small group, watch for failures, and roll out in stages.
When you find a suspicious stream
- Record the file path, the stream name, its size and its hash.
- Do not execute or open the content on a normal machine. Hand it to your malware analysis process.
- Find which process created it and when.
- Search for the same stream name and hash on other machines.
How to reduce the risk
MITRE lists one mitigation: restrict file and directory permissions. Consider adjusting read and write permissions for NTFS extended attributes, but test the change to make sure it does not interfere with routine operating system operations.
Check your own environment
All of these only read file data.
# Windows (cmd): show alternate data streams for files in a directory
dir /r
# Windows (PowerShell): list every stream on a file
Get-Item -Path .\example.txt -Stream *
# Windows (PowerShell): find files in a folder that carry any stream beyond the default
Get-ChildItem -Path C:\Users -Recurse -File -ErrorAction SilentlyContinue |
Get-Item -Stream * -ErrorAction SilentlyContinue |
Where-Object { $_.Stream -ne ':$DATA' -and $_.Stream -ne 'Zone.Identifier' }
The last command excludes the default stream and the Zone.Identifier stream that Windows adds to downloaded files. Anything else is worth reading.
Then work through the checklist:
- Do you collect Sysmon event 15 or an equivalent for stream creation on servers and high-value endpoints?
- Do your file scanning tools read all streams, not just the default one?
- Are there folders such as web roots or shared drives where nobody should ever create streams?
- Does your incident response checklist include listing streams on suspicious files?
Common mistakes
- Scanning only the default stream of each file and calling the result clean.
- Flagging the download marker stream on every file, which drowns out real findings.
- Changing extended attribute permissions broadly without testing them first.
Quick check
How do you refer to an alternate data stream in a file name?
With a colon and the stream name after the file name, such as file.ext:streamname.
Why can antivirus miss data in an ADS?
MITRE notes static scanning tools may only look at a file's main data, so content in other attributes goes unexamined.
