di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

The following blog post presents the concept of Alternate Data Stream and how it has been used in the wild, in the past as well as these days: as a te

Alternate_data_stream830x569.jpg

The following blog post presents the concept of Alternate Data Stream and how it has been used in the wild, in the past as well as these days: as a technique used to hide a malicious payload in the file system. Although it might be considered an old technique, it is still relevant today and common in the wild.<h2>What is an Alternate Data Stream?</h2>Alternate Data Stream (ADS) is the ability of an NTFS file system (the main file system format in Windows) to store different streams of data, in addition to the default stream which is normally used for a file. When this feature was created, its main purpose was to provide support to the macOS <a href="https://en.wikipedia.org/wiki/Hierarchical_File_System" target="_blank" rel="noopener noreferrer">Hierarchical File System</a> (HFS).The NTFS file system contains files with attributes. The relevant attribute for our scope is the $DATA attribute, which is used to store the data streams of a file.In the past, it was common to store a malicious payload within an ADS of a legitimate file. But today, many security solutions will detect and scan ADSs’. However, we will show you in this post, an ADS can still be used to run payloads while being hidden from the user as well as various security products.To simplify the concepts that are presented in this article, all the examples are based on native tools in Windows.<h2>How to Use ADS</h2>In the good old days of Windows Vista, Alternate Data Streams (ADS) was a common method for malware developers to hide their malicious code. An alternate Data Stream was effectively used to his the presence of malicious corrupting files, by squeezing it inside a legitimate file. &nbsp;By putting malware in the Alternate Data Stream, the Windows file would contain information and directions for the legitimate files, but also for the malicious file. In order to run the malicious code the hacker has deposited in the Alternate Data Stream, s/he would want to create a symlink using the mklink command. But doing this necessitates having administrative rights on the machine. Considering the normal behavior of a user doesn’t require running operating as an admin, hackers tend to approach their targets assuming that they land on a box without any admin rights.Enumeration - The mainstream under $DATA is the empty string (thus: “”, also called the unnamed stream). This stream is used to contain the regular stream of a file.The following is an example of enumerating the data streams of a file with PowerShell:<img class="alignnone size-full wp-image-1866" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5e349199b0283742/611a82e38d53e815d5044f97/w.png" width="838" height="105" style="width: 838px; height: 105px;"/>You can also use dir /R, or SysInternals\streams.exe to enumerate an ADS of a file / recursively on a directoryAs you can see above, the file only contains the unnamed stream.However, sometimes you can find an ADS within a legitimate file, as there are several legitimate uses for this technique.Below is an example of enumerating data streams of a file with an ADS with PowerShell:<img class="alignnone size-full wp-image-1867" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcac97e4608fadee8/611a82e39874b81619df297a/w2.png" width="840" height="132" style="width: 840px; height: 132px;"/> This is also an example of a legitimate use of ADS: the Zone. Identifier. This field presents the trust level of the file’s source. This is a browsers’ usage to store the Its macOS corresponding is the “quarantine bit”.Creation - While there can be legitimate uses for ADS, ADS can also be used to store a malicious payload. Attackers might prefer this method over saving the payload in the unnamed stream, because its presence will be hidden from the user – it is not accessible from explorer.exe (and the displayed size of a file does not include ADS’s size). In addition, it is not displayed by default with the “dir” command (however, /R flag displays ADS, and is applied from Windows Vista).Creating an ADS is quite simple.An example of creating an ADS with type command:<img class="alignnone size-full wp-image-1868" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf5d29629e4fd14f3/611a82e29e3e001656bdea92/w3.png" width="589" height="37" style="width: 589px; height: 37px;"/>Until Windows XP, it was possible to run an ADS with the start command. However, since later versions of Windows, it is no longer possible.Data Access - Abusing ADS is still a relevant threat, as there are multiple ways to read and execute an ADS.The first usage is accessing the data. The content of the ADS can be accessed easily. The following is an example with PowerShell:<img class="alignnone size-full wp-image-1869" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt32765446b44bfab5/611a82e2aa5dd6163af598af/w4.png" width="838" height="113" style="width: 838px; height: 113px;"/>Execution - In addition to reading the data, it is also possible to execute it. Although it’s not possible to execute an ADS with “start” command, it can still be run from other programs. For example, with WMI:“wmic process call creates” – runs a process with WMI. It can also run an ADS. Example:<img class="alignnone size-full wp-image-1870" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf38b881529dd2761/611a82d53ad228160f2ddf87/w5.png" width="625" height="366" style="width: 625px; height: 366px;"/>There are additional legitimate native tools of Windows that can be used to directly run an ADS. For example, a DLL can be saved inside an ADS and called by DllMain through rundll32.exe; also, an HTA can be saved inside an ADS and called through mshta.exe; and so on.<h2>Malicious Campaigns Abusing ADS</h2>It may seem that Windows has managed to handle the threats that reside within ADS. However, there are many malware families in the wild that still abuse ADS’s.<a href="https://nakedsecurity.sophos.com/2017/09/21/how-bitpaymer-ransomware-covers-its-tracks/" target="_blank" rel="noopener noreferrer">Another example from 2017 is BitPaymer</a>, ransomware which used two ADS’s in the attack sequence, in order to add stealth to the actions and hide malicious activity. The first ADS was created in order to run the “net view” command to obtain network shares, then the second ADS scrambles the data on the disk and network shares.To conclude, abusing ADS is a technique that is still relevant nowadays. Indeed, recent Windows versions have limited and hardened the functionality of ADS. However, basic command of native Windows tools such as Power-Shell and WMI, or some knowledge of Windows command-line allows threat actors to continue and leverage ADS in their attacks. Interestingly, recent campaigns using ADS are considered rather sophisticated and tend to minimize the use of persistent files on disk.<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5" target="_blank"><img id="hs-cta-img-9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5" class="hs-cta-img" style="width: 800px; height: 200px;" src="https://no-cache.hubspot.com/cta/default/2183098/9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5.png" alt="New call-to-action" width="800" height="200"/></a>

The Abuse of Alternate Data Stream Hasn't Disappeared

Discover how Deep Instinct DSX protects your NAS storage more effectively than Trellix.