NTFS Alternate Data Streams (ADS) are a feature of the Windows NT File System that allows additional data to be attached to a file outside the primary data stream. The primary stream is what you see when you open a file; any number of named secondary streams can be attached to the same file path using the syntax filename.ext:streamname. Directory listings, Windows Explorer, and most file management tools display only the primary stream. The alternate streams are invisible unless you know to look for them.

This makes ADS a persistent attraction for malware authors and post-exploitation tooling. A 100KB text file can carry a 2MB executable payload in an attached stream. Scripts can be written to a stream and executed directly. Persistence mechanisms can be embedded in streams attached to otherwise innocuous files. And because the file’s apparent size and content remain unchanged, cursory inspection misses it entirely.

How Attackers Use ADS

The most common ADS abuse patterns seen in incident investigations fall into three categories:

Payload storage: Malware drops a second-stage payload into an ADS rather than a standalone file. The initial dropper writes to C:\Windows\Temp\readme.txt:payload.exe and executes from the stream, avoiding the standalone executable that security tools would scrutinise.

Script concealment: PowerShell or VBScript content is written to a stream attached to a legitimate-looking file. The script is then executed by calling wscript.exe readme.txt:update.vbs or using PowerShell’s -Command parameter to invoke content from the stream path.

Zone identifier manipulation: Windows uses a special ADS (Zone.Identifier) to mark files downloaded from the internet with a source URL and zone ID. Malware that downloads payloads will sometimes strip this stream to prevent SmartScreen and Defender from treating the file as potentially untrusted. Conversely, attackers writing payloads directly to disk can attach a clean Zone.Identifier to reduce suspicion.

LSASS credential capture staging: Several post-exploitation frameworks write LSASS dumps to ADS rather than standalone files before exfiltration. The dump is attached to a system file that is unlikely to be deleted.

Detection Approach 1: Command-Line Arguments Containing Stream Syntax

The most reliable detection surface is process creation logs. ADS paths use the colon separator (file.ext:stream) in a way that is readily identifiable in command-line arguments. Legitimate software almost never invokes ADS paths from the command line.

title: Suspicious Process Execution from NTFS Alternate Data Stream
id: 8e4c3f91-2d17-4a8c-bc6e-9f1d2a3b5c7e
status: experimental
description: Detects process execution where command-line arguments reference NTFS Alternate Data Stream paths, a common malware persistence and payload delivery technique.
references:
  - https://attack.mitre.org/techniques/T1564/004/
author: SOC Analyst Hub
date: 2026-08-11
tags:
  - attack.defense_evasion
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ':.exe'
      - ':.ps1'
      - ':.vbs'
      - ':.js'
      - ':.bat'
      - ':.cmd'
      - ':.dll'
  filter_legitimate:
    CommandLine|contains:
      - 'Zone.Identifier'
      - ':$DATA'
  condition: selection and not filter_legitimate
falsepositives:
  - Some file sync clients that traverse ADS during indexing
  - Forensic tools run during incident investigations
level: high

KQL equivalent for Microsoft Sentinel:

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine matches regex @':[a-zA-Z0-9_\-]+\.(exe|ps1|vbs|js|bat|cmd|dll)'
| where ProcessCommandLine !contains "Zone.Identifier"
| where ProcessCommandLine !contains ":$DATA"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, 
          ProcessCommandLine, InitiatingProcessCommandLine, FolderPath
| order by TimeGenerated desc

Detection Approach 2: PowerShell Writing to ADS

PowerShell’s Set-Content and redirection operators (>) can write directly to alternate streams. Set-Content -Path "legit.txt:hidden.ps1" -Value $payload is a one-liner that writes a PowerShell payload to an ADS. Script block logging captures this.

title: PowerShell Writing to NTFS Alternate Data Stream
id: 3b7f1d09-9e4a-4c61-8d2e-1a5c7f3b9e2d
status: experimental
description: Detects PowerShell writing content to a NTFS Alternate Data Stream via Set-Content, Out-File, or redirect operators. Frequently used for payload staging.
author: SOC Analyst Hub
date: 2026-08-11
tags:
  - attack.defense_evasion
  - attack.t1564.004
logsource:
  category: ps_script
  product: windows
  definition: Script block logging must be enabled
detection:
  selection_ads_write:
    ScriptBlockText|contains:
      - 'Set-Content'
      - 'Out-File'
      - 'Add-Content'
  selection_colon_path:
    ScriptBlockText|re: '[\w\.\-]+:[\w\.\-]+'
  filter_benign:
    ScriptBlockText|contains:
      - 'Zone.Identifier'
      - 'HKLM:'
      - 'HKCU:'
      - 'Env:'
      - 'Function:'
      - 'Alias:'
      - 'Variable:'
  condition: selection_ads_write and selection_colon_path and not filter_benign
falsepositives:
  - Legitimate PowerShell scripts managing ADS for DRM or sync purposes
level: high

Note the filter: PowerShell uses colon syntax extensively for provider paths (HKLM:, Env:, Function:). The combination of a file write cmdlet AND a path that doesn’t match known provider prefixes narrows false positives significantly.

Detection Approach 3: Zone.Identifier Stream Deletion

Zone.Identifier deletion is a component of a broader “mark-of-the-web” removal pattern. It’s also observable through Streams.exe (Sysinternals), PowerShell’s Remove-Item, or the built-in icacls command on the stream.

title: Zone.Identifier ADS Deletion - Mark of the Web Removal
id: 5c2e8a17-4f9b-3d7c-a1e6-8b4c0f2d9e3a
status: experimental
description: Detects deletion of Zone.Identifier ADS, which marks internet-downloaded files as potentially unsafe. Malware frequently removes this stream to bypass SmartScreen and Defender alerting.
author: SOC Analyst Hub
date: 2026-08-11
tags:
  - attack.defense_evasion
  - attack.t1564.004
  - attack.t1553.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'Zone.Identifier'
    CommandLine|contains:
      - '/d'
      - 'Remove-Item'
      - '-delete'
      - 'streams'
  selection_powershell:
    CommandLine|contains:
      - 'Zone.Identifier'
      - 'Remove-Item'
  condition: selection_cmd or selection_powershell
falsepositives:
  - Enterprise software deployment tools that deliberately remove zone identifiers after validated package distribution
  - Developers testing download handling
level: medium

Detection Approach 4: Hunting for Executable Content in ADS at Scale

For retrospective hunts or forensic investigation, Velociraptor’s Windows.NTFS.AlternateDataStreams artifact can enumerate all ADS across a filesystem or targeted directories and flag streams containing executable or script content.

artifacts:
  - name: Windows.NTFS.AlternateDataStreams.Hunt
    parameters:
      - TargetDirectories:
          - C:\Users
          - C:\Windows\Temp
          - C:\ProgramData
    sources:
      - query: |
          SELECT FullPath, Name, Size, Mtime, 
                 read_file(filename=FullPath, length=4) AS Header
          FROM Artifact.Windows.NTFS.AlternateDataStreams()
          WHERE Size > 1000
          AND NOT Name =~ "Zone.Identifier|SmartScreen|encryptable|SummaryInformation"
          AND (
            Header =~ "MZ" OR   -- PE executable
            Header =~ "PK" OR   -- ZIP/JAR
            Header =~ "#!"      -- Script shebang
          )

This hunt targets streams over 1KB that begin with known executable magic bytes. MZ headers indicate PE executables; PK indicates archives; shebang sequences indicate scripts.

High-Value Detection Paths

Not all ADS activity is malicious. Browsers write Zone.Identifier streams to every downloaded file. Office writes summary streams to documents. Focus your alerts on:

  • Executable extensions in ADS paths invoked from process creation events — highest fidelity, rarely legitimate
  • ADS writes in temp directories and user profile paths — legitimate software rarely writes ADS to these locations
  • Streams on files in system directories with suspicious content — e.g., a stream on a DLL in System32 that contains a PowerShell payload
  • Zone.Identifier deletion events immediately followed by execution — the delete-then-run pattern is a near-certain indicator

For SIEMs with Windows Sysmon: Event ID 15 (FileCreateStreamHash) captures ADS creation events with the stream name and a hash of the content written. This is the highest-quality telemetry source for ADS monitoring — filter Event ID 15 for streams that aren’t Zone.Identifier and aren’t small (< 100 bytes) to eliminate most noise.