AN1206
Analytic 1206
Windows
Suspicious use of NTFS file attributes such as Alternate Data Streams (ADS) or Extended Attributes (EA) to hide data. Defender perspective: anomalous file creations or modifications containing colon syntax (file.ext:ads), API calls like ZwSetEaFile/ZwQueryEaFile, or PowerShell/Windows utilities interacting with -stream parameters. Correlation across file metadata anomalies, process lineage, and command execution provides context.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=15
etw:Microsoft-Windows-Kernel-File
ZwSetEaFile or ZwQueryEaFile function calls
[ADSPathWhitelist]
Exclude legitimate ADS usage by system or AV tools.
[ProcessScope]
Restrict monitoring to suspicious parent processes (e.g., powershell.exe, cmd.exe, wscript.exe).
[TimeWindow]
Correlate ADS creation with subsequent process execution to strengthen malicious context.