PowerShell Write to NTFS Alternate Data Stream

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects attempts to write data into NTFS Alternate Data Streams (ADS) using PowerShell cmdlets like `Set-Content` or `Add-Content` in conjunction with the `-Stream` parameter. This technique can be used by adversaries to hide malicious data or executables on a system.