NTFS File Attributes

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine matches regex @":\w+\.\w+"
   or ProcessCommandLine has "streams" or ProcessCommandLine has "/ads"
   or (FileName =~ "powershell.exe" and ProcessCommandLine has "Get-Item" and ProcessCommandLine has "Stream")
   or (FileName =~ "powershell.exe" and ProcessCommandLine has "Add-Content" and ProcessCommandLine has ":")
| extend ADSWrite = ProcessCommandLine matches regex @"echo.+>.*:\w+"
| extend PowerShellADS = ProcessCommandLine has_any ("Get-Item", "Set-Content", "Add-Content") and ProcessCommandLine has ":"
| extend StreamsUtil = ProcessCommandLine has_any ("streams.exe", "streams64.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName,
         ADSWrite, PowerShellADS, StreamsUtil
| sort by Timestamp desc
union (
  DeviceFileEvents
  | where Timestamp > ago(24h)
  | where FileName contains ":"
  | where ActionType in ("FileCreated", "FileModified")
  | project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, ActionType
  | sort by Timestamp desc
)

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=15
| eval SuspiciousADS=if(match(TargetFilename, ":[a-zA-Z0-9]+\.[a-zA-Z0-9]+$") AND NOT match(TargetFilename, ":Zone.Identifier"), 1, 0)
| where SuspiciousADS=1
| table _time, host, User, TargetFilename, Hash, Image
| sort - _time
union
[search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\powershell.exe" OR Image="*\\cmd.exe")
(CommandLine="*:\\*" AND (CommandLine="*Get-Item*" OR CommandLine="*Set-Content*" OR CommandLine="*Add-Content*"))
| eval ADSPowerShell=1
| table _time, host, User, Image, CommandLine, ADSPowerShell]

any where
  (
    /* Sysmon EventCode 15 - FileCreateStreamHash: non-standard ADS stream written to disk */
    event.code == "15" and
    file.path : "*:*" and
    not file.path : "*:Zone.Identifier*"
  ) or
  (
    /* Process creation events with ADS manipulation patterns */
    event.category : "process" and event.type : "start" and
    (
      /* PowerShell ADS read/write via built-in cmdlets */
      (process.name : ("powershell.exe", "pwsh.exe") and
       process.command_line : ("*Get-Item*:*", "*Set-Content*:*", "*Add-Content*:*", "*Get-Content*:*") and
       not process.command_line : "*Zone.Identifier*") or
      /* cmd.exe echo redirect to ADS: echo payload > legit.txt:hidden.exe */
      (process.name : "cmd.exe" and
       process.command_line : ("*echo*:*.*", "*> *:*.*") and
       not process.command_line : "*Zone.Identifier*") or
      /* Sysinternals Streams utility for ADS enumeration */
      process.name : ("streams.exe", "streams64.exe") or
      /* Generic /ads or -ads flags used by ADS-aware tools */
      (process.command_line : ("*/ads*", "*-ads*") and
       not process.command_line : "*Zone.Identifier*")
    )
  )

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip AS source_ip,
  username AS user_name,
  QIDNAME(qid) AS event_name,
  LOGSOURCENAME(logsourceid) AS log_source,
  LOGSOURCETYPEID(logsourceid) AS log_source_type,
  UTF8(payload) AS raw_event
FROM events
WHERE
  starttime > (CURRENT_TIMESTAMP - 86400000)
  AND LOGSOURCETYPEID IN (12, 13)
  AND (
    /* Sysmon EventCode 15: FileCreateStreamHash - ADS stream creation */
    (
      (QIDNAME(qid) ILIKE '%FileCreateStreamHash%'
       OR QIDNAME(qid) ILIKE '%Sysmon%15%')
      AND UTF8(payload) MATCHES '.*:[A-Za-z0-9_-]+\\.[A-Za-z0-9]+.*'
      AND UTF8(payload) NOT ILIKE '%Zone.Identifier%'
    )
    OR
    /* Sysmon EventCode 1 / Windows EventCode 4688: Process creation with ADS patterns */
    (
      (QIDNAME(qid) ILIKE '%Process Create%'
       OR QIDNAME(qid) ILIKE '%ProcessCreate%'
       OR QIDNAME(qid) ILIKE '%4688%')
      AND (
        /* PowerShell ADS cmdlets */
        (UTF8(payload) ILIKE '%powershell.exe%'
         AND (
           UTF8(payload) ILIKE '%Get-Item%'
           OR UTF8(payload) ILIKE '%Set-Content%'
           OR UTF8(payload) ILIKE '%Add-Content%'
         )
         AND UTF8(payload) NOT ILIKE '%Zone.Identifier%'
         AND UTF8(payload) LIKE '%:%')
        /* Sysinternals Streams utility */
        OR UTF8(payload) ILIKE '%streams.exe%'
        OR UTF8(payload) ILIKE '%streams64.exe%'
        /* ADS enumeration flags */
        OR UTF8(payload) ILIKE '% /ads%'
        OR UTF8(payload) ILIKE '% -ads%'
        /* cmd.exe echo redirect to ADS */
        OR UTF8(payload) MATCHES '.*echo.*>.*:[A-Za-z0-9_]+\\.[A-Za-z0-9]+.*'
      )
    )
  )
ORDER BY starttime DESC

(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*winlogbeat*)
(EventCode=15 OR EventCode=1)
| parse regex "EventCode(?:Id)?[=: ]+(?P<EventCode>\\d+)" nodrop
| parse regex "Image[=: ]+(?P<Image>[^\r\n]+)" nodrop
| parse regex "CommandLine[=: ]+(?P<CommandLine>[^\r\n]+)" nodrop
| parse regex "TargetFilename[=: ]+(?P<TargetFilename>[^\r\n]+)" nodrop
| parse regex "User(?:Name)?[=: ]+(?P<User>[^\r\n]+)" nodrop
| parse regex "Computer(?:Name)?[=: ]+(?P<Computer>[^\r\n]+)" nodrop
| parse regex "Hashes[=: ]+(?P<Hashes>[^\r\n]+)" nodrop
| parse regex "ParentImage[=: ]+(?P<ParentImage>[^\r\n]+)" nodrop
| where (
    /* Sysmon Event 15: ADS file stream hash — non-Zone.Identifier stream written */
    (EventCode = "15"
     AND TargetFilename matches /:[a-zA-Z0-9_\-]+\.[a-zA-Z0-9]+$/
     AND !(TargetFilename matches /:Zone\.Identifier/))
    OR
    /* Sysmon Event 1: Process creation with ADS manipulation */
    (EventCode = "1"
     AND (
       Image matches /(?i)(streams|streams64)\.exe$/
       OR CommandLine matches /(?i)\/ads/
       OR (
         Image matches /(?i)(powershell|pwsh)\.exe$/
         AND (
           CommandLine matches "Get-Item"
           OR CommandLine matches "Set-Content"
           OR CommandLine matches "Add-Content"
         )
         AND CommandLine contains ":"
         AND !(CommandLine matches /:Zone\.Identifier/)
       )
       OR (
         Image matches /(?i)cmd\.exe$/
         AND CommandLine matches /echo.+>.*:[a-zA-Z0-9_]+\.[a-zA-Z0-9]+/
       )
     ))
  )
| eval DetectionType = if(EventCode = "15", "ADS_FileStream_Created",
    if(Image matches /(?i)(streams|streams64)\.exe$/, "ADS_StreamsUtility",
    if(Image matches /(?i)(powershell|pwsh)\.exe$/, "ADS_PowerShell",
    "ADS_CmdRedirect")))
| fields _time, Computer, User, TargetFilename, CommandLine, Image, ParentImage, EventCode, DetectionType, Hashes
| sort by _time desc

rule ntfs_alternate_data_stream_detection {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects NTFS Alternate Data Stream (ADS) abuse for payload hiding and defense evasion (T1564.004). Covers ADS file creation, PowerShell ADS cmdlets, cmd.exe echo redirects, and Sysinternals Streams utility. Excludes Zone.Identifier streams."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1564.004"
    reference = "https://attack.mitre.org/techniques/T1564/004/"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    (
      /* FILE_CREATION with ADS notation: file.txt:hidden_payload.exe */
      (
        $e.metadata.event_type = "FILE_CREATION" and
        strings.contains($e.target.file.full_path, ":") and
        not re.regex($e.target.file.full_path, `:Zone\.Identifier`)
      )
      or
      /* Sysinternals Streams.exe: ADS enumeration or removal utility */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.file.full_path, `(?i)(streams|streams64)\.exe$`)
      )
      or
      /* PowerShell ADS read/write: Get-Item, Set-Content, Add-Content with colon path */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(Get-Item|Set-Content|Add-Content|Get-Content)`) and
        strings.contains($e.target.process.command_line, ":") and
        not re.regex($e.target.process.command_line, `:Zone\.Identifier`)
      )
      or
      /* cmd.exe echo redirect to ADS: echo data > file.txt:stream.exe */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.file.full_path, `(?i)cmd\.exe$`) and
        re.regex($e.target.process.command_line, `echo.+>.*:[a-zA-Z0-9_]+\.[a-zA-Z0-9]+`)
      )
      or
      /* Generic process: command line references ADS stream notation */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.command_line, `:[a-zA-Z0-9_\-]+\.[a-zA-Z0-9]+`) and
        not re.regex($e.target.process.command_line, `:Zone\.Identifier`) and
        not re.regex($e.target.process.command_line, `(?i)^[a-zA-Z]:\\\\`)
      )
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| (
    CommandLine = /:[a-zA-Z0-9_\-]+\.[a-zA-Z0-9]+/
    OR ImageFileName = /(?i)(streams|streams64)\.exe$/
    OR (
      ImageFileName = /(?i)(powershell|pwsh)\.exe$/
      AND CommandLine = /(?i)(Get-Item|Set-Content|Add-Content|Get-Content)/
      AND CommandLine = /:/
    )
    OR (
      ImageFileName = /(?i)cmd\.exe$/
      AND CommandLine = /echo.+>.*:[a-zA-Z0-9_]+\.[a-zA-Z0-9]+/
    )
  )
| CommandLine != /Zone\.Identifier/
| CommandLine != /(?i)^[a-zA-Z]:\\\\/
| case {
    ImageFileName = /(?i)(streams|streams64)\.exe$/ | ADSType := "StreamsUtility";
    ImageFileName = /(?i)(powershell|pwsh)\.exe$/ AND CommandLine = /(?i)(Get-Item|Set-Content|Add-Content)/ | ADSType := "PowerShellADS";
    ImageFileName = /(?i)cmd\.exe$/ AND CommandLine = /echo.+>.*:[a-zA-Z0-9_]+\.[a-zA-Z0-9]+/ | ADSType := "CmdEchoADS";
    * | ADSType := "ADSCommandPattern";
  }
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentImageFileName, ParentCommandLine, ADSType, UserSid], limit=1000)
| sort(@timestamp, order=desc)