Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•13

Detects command line arguments that include '::$index_allocation', which is a technique used to create hidden directories or files within the NTFS file system. This method can prevent standard tools like 'explorer.exe' or 'powershell.exe' from accessing or listing these hidden artifacts, serving as a defense evasion tactic.