# NTFS File Attributes
Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data \[known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).
Adversaries may store malicious data or binaries in the file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus.
**Example:**
Alternate Data Stream is an Artifact of New Technology File Systems (NTFS) which was introduced by Windows. Attackers introduced a method where they managed to hide payloads, malware, keyloggers and have them execute without the knowledge of the users.
A file can have more than one Alternate Data Stream for the various purpose to hold metadata of the file. When you append an ADS File with a default stream file, there will be no change made to the size or the function of the file.
Here, we are making use of .txt file as our primary stream to demonstrate ADS, you can use any file of your preference.
We create a file and add content.
To display The contents in the folder including Alternate Data Stream we use **dir /r**
]
In the above image, you can see that there is no hidden file displayed, and on the GUI you see that there is only 1 file.
Here we will proceed with creating a hidden file. A .txt file is created with hidden ADS and to add content in the file we can use the command:
**echo Hello World, Again!! > Hello-World.txt:hidden**
To display contents I used the previous commands.
But to no luck, here you see that the file is not recognized, therefore, to see hidden content you can use the **more** command.
And to view the DataStream we check it again with the **dir /r** command.
You can also open this file with notepad and the contents will be displayed as well. For more information and even with the use of PowerShell here are some references.
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1564-hide-artifacts/ntfs-file-attributes.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.