SigmaHQ/rules/windows/powershell/powershell_ntfs_ads_access.yml

title: NTFS Alternate Data Stream
status: experimental
description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
references:
    - http://www.powertheshell.com/ntfsstreams/
tags:
    - attack.defense_evasion
    - attack.t1096
author: Sami Ruohonen
logsource:
    product: windows
    service: powershell
    definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'
detection:
    keyword1:
        - "set-content"
    keyword2:
        - "-stream"
    condition: keyword1 and keyword2
falsepositives:
    - unknown
level: high
Create powershell_NTFS_Alternate_Data_Streams 2018-07-24 17:49:08 +00:00			`title: NTFS Alternate Data Stream`
			`status: experimental`
Update powershell_NTFS_Alternate_Data_Streams 2018-07-26 15:54:08 +00:00			`description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.`
Create powershell_NTFS_Alternate_Data_Streams 2018-07-24 17:49:08 +00:00			`references:`
			`- http://www.powertheshell.com/ntfsstreams/`
			`tags:`
ATT&CK tagging QA 2018-09-20 10:44:44 +00:00			`- attack.defense_evasion`
Create powershell_NTFS_Alternate_Data_Streams 2018-07-24 17:49:08 +00:00			`- attack.t1096`
Update powershell_NTFS_Alternate_Data_Streams 2018-07-24 18:03:07 +00:00			`author: Sami Ruohonen`
Create powershell_NTFS_Alternate_Data_Streams 2018-07-24 17:49:08 +00:00			`logsource:`
			`product: windows`
			`service: powershell`
Replace "logsource: description" with "definition" to match the specs 2018-11-15 06:00:06 +00:00			`definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'`
Create powershell_NTFS_Alternate_Data_Streams 2018-07-24 17:49:08 +00:00			`detection:`
Changes I think that this is what you've wanted, right? If both keywords appear in a single log entry, right? Don't you think that this still causes false positives? Could "set-content" and "stream" be more common than expected? 2018-07-25 05:35:59 +00:00			`keyword1:`
Added quotation marks I've added quotation marks to make it clearer (leading dash looks weird) 2018-07-26 16:10:21 +00:00			`- "set-content"`
Changes I think that this is what you've wanted, right? If both keywords appear in a single log entry, right? Don't you think that this still causes false positives? Could "set-content" and "stream" be more common than expected? 2018-07-25 05:35:59 +00:00			`keyword2:`
Added quotation marks I've added quotation marks to make it clearer (leading dash looks weird) 2018-07-26 16:10:21 +00:00			`- "-stream"`
Changes I think that this is what you've wanted, right? If both keywords appear in a single log entry, right? Don't you think that this still causes false positives? Could "set-content" and "stream" be more common than expected? 2018-07-25 05:35:59 +00:00			`condition: keyword1 and keyword2`
Create powershell_NTFS_Alternate_Data_Streams 2018-07-24 17:49:08 +00:00			`falsepositives:`
			`- unknown`
			`level: high`