Payload Hidden in NTFS Alternate Data Stream

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects network traffic over SMB (port 445) that contains patterns indicative of a payload hidden within an NTFS Alternate Data Stream (ADS). Specifically, it looks for the string ":$DATA" followed by ".exe" (case-insensitive) in the TCP payload, which is a common technique used by malware to conceal executable files within legitimate files.