NTFS Alternate Data Stream Used to Hide Payload
Detects NTFS ADS used to hide malicious payloads from standard directory listings
Microsoft Sentinel (KQL)

Detects NTFS ADS used to hide malicious payloads from standard directory listings

Already have an account?