NTFS ADS execution hidden via anomalous Prefetch stream/placeholder

Renata Cardoso@rcardososec

•updated Jul 23, 2026•1•0•7

Detects the execution of an executable file stored within an NTFS Alternate Data Stream (ADS) on Windows systems. The rule correlates a process launch from a file path containing an ADS colon syntax with the creation of an anomalous file in the Windows Prefetch directory that masquerades as common image or text file types (png, jpg, jpeg, txt, dat). This behavior is characteristic of adversaries attempting to hide malicious binaries in ADS while interfering with or manipulating system forensic artifacts.