Hidden Executable In NTFS Alternate Data Stream

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•46

This rule detects the creation of an Alternate Data Stream (ADS) that contains an executable file. It specifically looks for the presence of a non-empty Import Hash (Imphash) within the created stream, indicating executable content. The rule filters out streams with a null Imphash, which typically correspond to non-executable data.