How can malware be hidden using NTFS Alternate Data Streams

Question

I am researching Windows security and came across NTFS Alternate Data Streams (ADS) as a technique used to hide malicious files. I want to understand:

• How attackers embed malware into ADS without detection.
• How to list and analyze ADS on a Windows system.
• How security tools detect and mitigate ADS-based attacks.
  A practical example of creating and detecting ADS in PowerShell would be helpful.

Answer 1

NTFS Alternate Data Streams (ADS) are a feature of the NTFS file system that allow multiple data streams to be associated with a single file. While intended for legitimate purposes, such as storing file metadata, attackers can exploit ADS to conceal malicious code, making detection challenging.

1. Concealing Malware Using ADS

Attackers can embed malware within ADS to hide their presence:

• Embedding Malicious Code: By attaching malicious executables or scripts to the ADS of legitimate files, attackers can execute harmful code without altering the apparent size or functionality of the host file.

  Example:

echo MaliciousCode > legitimate.txt:malware.exe

In this scenario, malware.exe is hidden within the ADS of legitimate.txt.

• Evasion of Standard Detection: Since standard file listing commands and many antivirus programs do not inspect ADS by default, malware stored in ADS can evade detection. This stealth technique allows malicious code to persist on a system unnoticed.

2. Listing and Analyzing ADS on a Windows System

To detect and analyze ADS, you can use built-in Windows tools and PowerShell commands:

• Using Command Prompt:

  The dir command with the /R flag displays files with their associated ADS:

dir /R

This command lists all files in the directory, including their alternate data streams.

• Using PowerShell:

  PowerShell provides cmdlets to interact with ADS:

  • Listing ADS:

    Get-Item -Path "C:\path\to\file.txt" -Stream *

    This command lists all streams associated with file.txt.

  • Reading ADS Content:

    Get-Content -Path "C:\path\to\file.txt" -Stream "streamname"

    Replace "streamname" with the name of the ADS you wish to read.

  • Removing ADS:

    Remove-Item -Path "C:\path\to\file.txt" -Stream "streamname"

    This command deletes the specified ADS from the file.

3. Detection and Mitigation of ADS-Based Attacks

Security tools and practices can help detect and prevent ADS-based malware:

• Antivirus and Anti-Malware Solutions:

  Modern security software often includes features to scan for and detect malicious ADS. Ensure your antivirus definitions are up-to-date and that your security software is configured to scan all data streams.

• Specialized Tools:

  Utilities like Sysinternals' Streams can enumerate ADS on a system:

streams.exe -s C:\

This command recursively scans the C: drive for files containing ADS.

• Regular Audits:

  Implement routine checks of your file systems for unexpected ADS, especially in directories where executable files reside.

4. Practical Example: Creating and Detecting ADS with PowerShell

Here's how you can create and detect an ADS using PowerShell:

• Creating an ADS:

  # Create a new file
  Set-Content -Path "C:\path\to\example.txt" -Value "This is the main file content."

  # Add an alternate data stream
  Set-Content -Path "C:\path\to\example.txt" -Stream "hiddenStream" -Value "This is hidden malicious content."

• Detecting ADS:

  # List all streams associated with the file
  Get-Item -Path "C:\path\to\example.txt" -Stream *

  # Output:
  #   FileName: C:\path\to\example.txt
  #   Stream: :$DATA
  #   Length: 31

  #   FileName: C:\path\to\example.txt
  #   Stream: hiddenStream
  #   Length: 30

This output shows the default data stream (:$DATA) and the hidden stream (hiddenStream).

• Reading the Hidden ADS Content:

  # Read the content of the hidden stream
  Get-Content -Path "C:\path\to\example.txt" -Stream "hiddenStream"

  # Output:
  # This is hidden malicious content.

By understanding and monitoring ADS, you can enhance your system's security posture against threats that utilize this feature for malicious purposes.