Execute From Alternate Data Streams
Detects execution from an Alternate Data Stream (ADS) using various Windows utilities. Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. The rule specifically looks for command-line patterns indicative of reading from an ADS (e.g., 'txt:') combined with common tools like 'type', 'makecab', 'reg', 'regedit', or 'esentutl' that can interact with or extract data from streams.
Sigma
