WScript Execution From Alternate Data Stream (ADS)

Duo Tech@duotech

•updated Jun 4, 2026•0•0•10

Detects wscript.exe or cscript.exe executing a script hidden within an NTFS Alternate Data Stream (ADS). This technique is notably used by the Gamaredon group's GammaWorm to maintain fileless persistence and conceal malicious VBScript payloads (e.g., %USERPROFILE%:GTR).