Hidden Executable In NTFS Alternate Data Stream

SigmaHQ Detections@sigmaHQ

•updated Feb 10, 2023•0•0•0

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash