T1564.004 NTFS File Attributes

Technique

T1564.004

Tactics

Defense Evasion

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

23

Elastic, Splunk

10

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1564/004

MITRE description

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition.(Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes,(Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).(Citation: SpectorOps Host-Based Jul 2017)(Citation: Microsoft File Streams)(Citation: MalwareBytes ADS July 2015)(Citation: Microsoft ADS Mar 2014) Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus.(Citation: Journey into IR ZeroAccess NTFS EA)(Citation: MalwareBytes ADS July 2015)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-15 Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering

Detection coverage

SigmaHQ community rules

• Use Short Name Path in Command Line (threat-hunting)
• Hidden Flag Set On File/Directory Via Chflags - MacOS (core)
• Hidden Executable In NTFS Alternate Data Stream (core)
• Suspicious File Download From File Sharing Websites - File Stream (core)
• Unusual File Download From File Sharing Websites - File Stream (core)
• HackTool Named File Stream Created (core)
• Exports Registry Key To an Alternate Data Stream (core)
• Unusual File Download from Direct IP Address (core)
• Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream (core)
• NTFS Alternate Data Stream (core)
• Powershell Store File In Alternate Data Stream (core)
• Remote File Download Via Findstr.EXE (core)
• Insensitive Subfolder Search Via Findstr.EXE (core)
• Suspicious Diantz Alternate Data Stream Execution (core)
• Suspicious Extrac32 Alternate Data Stream Execution (core)
• PrintBrm ZIP Creation of Extraction (core)
• Run PowerShell Script from ADS (core)
• Potential Rundll32 Execution With DLL Stored In ADS (core)
• Execute From Alternate Data Streams (core)
• Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI (core)
• Use Short Name Path in Image (core)
• Use NTFS Short Name in Command Line (core)
• Use NTFS Short Name in Image (core)

Elastic and Splunk rules

• Potential Evasion via Boot Time Removal Tool (elastic)
• Alternate Data Stream Creation/Execution at Volume Root Directory (elastic)
• Unusual File Creation - Alternate Data Stream (elastic)
• Unusual Process Execution Path - Alternate Data Stream (elastic)
• Windows Alternate Data Stream Created Over Local Share (splunk)
• Windows Alternate DataStream - Base64 Content (splunk)
• Windows Alternate DataStream - Executable Content (splunk)
• Windows Alternate DataStream - Process Execution (splunk)
• Windows SymbolicLink-Testing-Tools Utility Execution (splunk)
• Windows Wermgr Alternate Data Stream in Temp Dir (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.