Detect NTFS File Attributes in Google Chronicle

rule ntfs_alternate_data_stream_detection {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects NTFS Alternate Data Stream (ADS) abuse for payload hiding and defense evasion (T1564.004). Covers ADS file creation, PowerShell ADS cmdlets, cmd.exe echo redirects, and Sysinternals Streams utility. Excludes Zone.Identifier streams."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1564.004"
    reference = "https://attack.mitre.org/techniques/T1564/004/"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    (
      /* FILE_CREATION with ADS notation: file.txt:hidden_payload.exe */
      (
        $e.metadata.event_type = "FILE_CREATION" and
        strings.contains($e.target.file.full_path, ":") and
        not re.regex($e.target.file.full_path, `:Zone\.Identifier`)
      )
      or
      /* Sysinternals Streams.exe: ADS enumeration or removal utility */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.file.full_path, `(?i)(streams|streams64)\.exe$`)
      )
      or
      /* PowerShell ADS read/write: Get-Item, Set-Content, Add-Content with colon path */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(Get-Item|Set-Content|Add-Content|Get-Content)`) and
        strings.contains($e.target.process.command_line, ":") and
        not re.regex($e.target.process.command_line, `:Zone\.Identifier`)
      )
      or
      /* cmd.exe echo redirect to ADS: echo data > file.txt:stream.exe */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.file.full_path, `(?i)cmd\.exe$`) and
        re.regex($e.target.process.command_line, `echo.+>.*:[a-zA-Z0-9_]+\.[a-zA-Z0-9]+`)
      )
      or
      /* Generic process: command line references ADS stream notation */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.command_line, `:[a-zA-Z0-9_\-]+\.[a-zA-Z0-9]+`) and
        not re.regex($e.target.process.command_line, `:Zone\.Identifier`) and
        not re.regex($e.target.process.command_line, `(?i)^[a-zA-Z]:\\\\`)
      )
    )

  condition:
    $e
}