NTFS File Attributes

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).

Adversaries may store malicious data or binaries in the file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus.

Example:

Alternate Data Stream is an Artifact of New Technology File Systems (NTFS) which was introduced by Windows. Attackers introduced a method where they managed to hide payloads, malware, keyloggers and have them execute without the knowledge of the users.

A file can have more than one Alternate Data Stream for the various purpose to hold metadata of the file. When you append an ADS File with a default stream file, there will be no change made to the size or the function of the file.

Here, we are making use of .txt file as our primary stream to demonstrate ADS, you can use any file of your preference.

We create a file and add content.

To display The contents in the folder including Alternate Data Stream we use dir /r

]

In the above image, you can see that there is no hidden file displayed, and on the GUI you see that there is only 1 file.

Here we will proceed with creating a hidden file. A .txt file is created with hidden ADS and to add content in the file we can use the command:

echo Hello World, Again!! > Hello-World.txt:hidden

To display contents I used the previous commands.

But to no luck, here you see that the file is not recognized, therefore, to see hidden content you can use the more command.

And to view the DataStream we check it again with the dir /r command.

You can also open this file with notepad and the contents will be displayed as well. For more information and even with the use of PowerShell here are some references.

Defense Evasion: Alternate Data Streams - Hacking ArticlesHacking Articles

Using Alternate Data Streams to Persist on a Compromised Machineenigma0x3

Attack Step 3: Persistence with NTFS Extended Attributes - File System AttacksStealthbits Technologies