Unsigned process creates an Alternate Data Stream (ADS)

BIOC Informational

Unsigned process creates an Alternate Data Stream (ADS)

Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS.

Module:: Platform Analytics
Agent event type:: File
Category:: Evasion
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)

Indicator:

File file name = *:* AND action type = create Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

Preventable: yes