Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"