{"id":"0900463c-b33b-49a8-be1d-552a3b553dae","title":"Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI","description":"Detects command line containing reference to the \"::$index_allocation\" stream, which can be used as a technique to prevent access to folders or files from tooling such as \"explorer.exe\" or \"powershell.exe\"\n","author":"Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)","status":"test","level":"medium","date":"2023-10-09","modified":"","tags":["attack.stealth","attack.t1564.004"],"technique_ids":["T1564.004"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unlikely"],"references":["https://twitter.com/pfiatde/status/1681977680688738305","https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/","https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/","https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation","https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml","source_sha256":"e85329b3cb132b67951ac1d34fd2580df3a87bbec08c9d2f4316fecf0ec1a487","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI\nid: 0900463c-b33b-49a8-be1d-552a3b553dae\nrelated:\n    - id: a8f866e1-bdd4-425e-a27a-37619238d9c7\n      type: similar\nstatus: test\ndescription: |\n    Detects command line containing reference to the \"::$index_allocation\" stream, which can be used as a technique to prevent access to folders or files from tooling such as \"explorer.exe\" or \"powershell.exe\"\nreferences:\n    - https://twitter.com/pfiatde/status/1681977680688738305\n    - https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/\n    - https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/\n    - https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation\n    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3\nauthor: Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)\ndate: 2023-10-09\ntags:\n    - attack.stealth\n    - attack.t1564.004\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        # Note: Both Sysmon and ETW are unable to log the presence of such stream in the CommandLine. But EDRs such as Crowdstrike are able to using for example CMD console history. Users are advised to test this before usage\n        CommandLine|contains: '::$index_allocation'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","page":"techniques/enterprise/T1564.004/"}],"data_path":"data/detection-rules/0900463c-b33b-49a8-be1d-552a3b553dae.json","kind":"sigma"}