{"id":"a8f866e1-bdd4-425e-a27a-37619238d9c7","title":"Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream","description":"Detects the creation of hidden file/folder with the \"::$index_allocation\" stream. Which can be used as a technique to prevent access to folder and files from tooling such as \"explorer.exe\" and \"powershell.exe\"\n","author":"Scoubi (@ScoubiMtl)","status":"test","level":"medium","date":"2023-10-09","modified":"","tags":["attack.stealth","attack.t1564.004"],"technique_ids":["T1564.004"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unlikely"],"references":["https://twitter.com/pfiatde/status/1681977680688738305","https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/","https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/","https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation","https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3"],"source_path":"rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml","source_sha256":"6926a598d515ea2b76a448638a6fcf0c038a1624b7a5385f58eac4ddef592f05","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream\nid: a8f866e1-bdd4-425e-a27a-37619238d9c7\nrelated:\n    - id: 0900463c-b33b-49a8-be1d-552a3b553dae\n      type: similar\nstatus: test\ndescription: |\n    Detects the creation of hidden file/folder with the \"::$index_allocation\" stream. Which can be used as a technique to prevent access to folder and files from tooling such as \"explorer.exe\" and \"powershell.exe\"\nreferences:\n    - https://twitter.com/pfiatde/status/1681977680688738305\n    - https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/\n    - https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/\n    - https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation\n    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3\nauthor: Scoubi (@ScoubiMtl)\ndate: 2023-10-09\ntags:\n    - attack.stealth\n    - attack.t1564.004\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        # Note: Both Sysmon and ETW are unable to log the presence of such streams in the CommandLine. But EDRs such as Crowdstrike are able to use e.g. CMD console history. Users are advised to test this before usage\n        TargetFilename|contains: '::$index_allocation'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","page":"techniques/enterprise/T1564.004/"}],"data_path":"data/detection-rules/a8f866e1-bdd4-425e-a27a-37619238d9c7.json","kind":"sigma"}