NTFS Alternate Data Stream Execution - LOLBAS

Hypothesis and description

NTFS Alternate Data Streams (ADSs) may be used by adversaries as a means of evading security tools by storing malicious data or binaries in file attribute metadata. ADSs are also powerful because their contents can be directly executed by various Windows tools; accordingly, this analytic looks at common ways of executing ADSs using Living off the Land Binaries and Scripts (LOLBAS).

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-08-03
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1564 Hide ArtifactsT1564.004	Stealth (formerly Defense Evasion)	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1564Hide Artifacts
.004 NTFS File Attributes

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodeNTFS ADS - pseudocodeData model: CAR native

This is generic pseudocode that lines up with the below Splunk queries.

processes = search Process:Create
ads_processes = filter processes where (
exe == "control.exe OR appvlp.exe OR cmd.exe OR ftp.exe OR bash.exe OR mavinject.exe OR bitsadmin.exe" and command_line.matches("__some_regex__")
)
output ads_processes

SplunkNTFS ADS - controlData model: Sysmon native

This Splunk query looks for invocations of control.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\System32\\control.exe OR Image=C:\\Windows\SysWOW64\\control.exe) | regex CommandLine="(\w+(\.\w+)?):(\w+\.dll)"

SplunkNTFS ADS - appvlpData model: Sysmon native

This Splunk query looks for invocations of appvlp.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image="C:\\Program Files\\Microsoft Office\\root\\Client\\AppVLP.exe" OR Image="C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\AppVLP.exe") | regex CommandLine="(\w+(\.\w+)?):(\w+(\.\w+)?)"

SplunkNTFS ADS - cmdData model: Sysmon native

This Splunk query looks for invocations of cmd.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\cmd.exe OR Image=C:\\Windows\\SysWOW64\\cmd.exe) | regex CommandLine="-\s+<.*\b(\w+(\.\w+)?):(\w+(\.\w+)?)"

SplunkNTFS ADS - ftpData model: Sysmon native

This Splunk query looks for invocations of ftp.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\ftp.exe OR Image=C:\\Windows\\SysWOW64\\ftp.exe) | regex CommandLine="-s:(\w+(\.\w+)?):(\w+(\.\w+)?)"

SplunkNTFS ADS - bashData model: Sysmon native

This Splunk query looks for invocations of bash.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\bash.exe OR C:\\Windows\\SysWOW64\\bash.exe) | regex CommandLine="-c.*(\w+(\.\w+)?):(\w+(\.\w+)?)"

SplunkNTFS ADS - mavinjectData model: Sysmon native

This Splunk query looks for invocations of mavinject.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\mavinject.exe OR C:\\Windows\\SysWOW64\\mavinject.exe) | regex CommandLine="\d+\s+\/INJECTRUNNING.*\b(\w+(\.\w+)?):(\w+(\.\w+)?)"

SplunkNTFS ADS - bitsadminData model: Sysmon native

This Splunk query looks for invocations of bitsadmin.exe used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\System32\\bitsadmin.exe OR C:\\Windows\\SysWOW64\\bitsadmin.exe) | regex CommandLine="\/create.*\/addfile.*\/SetNotifyCmdLine.*\b(\w+\.\w+):(\w+(\.\w+)?)"

References (from MITRE CAR)

The LOLBAS project is an amazing resource and was used as the basis for many of these analytics.
Oddvar Moe has created an excellent NTFS ADS execution reference here on github.

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

16 more in the full list

View CAR-2020-08-002 on car.mitre.org