SigmaHQ/rules/windows/powershell/powershell_ntfs_ads_access.yml
2020-01-30 16:07:37 +01:00

25 lines
701 B
YAML

title: NTFS Alternate Data Stream
id: 8c521530-5169-495d-a199-0a3a881ad24e
status: experimental
description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
references:
- http://www.powertheshell.com/ntfsstreams/
tags:
- attack.defense_evasion
- attack.t1096
author: Sami Ruohonen
date: 2018/07/24
logsource:
product: windows
service: powershell
definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'
detection:
keyword1:
- "set-content"
keyword2:
- "-stream"
condition: keyword1 and keyword2
falsepositives:
- unknown
level: high