All Detections

NTFS Alternate Data Stream

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025012

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

Sigma