T1564.004 — NTFS File Attributes

Tactic: Stealth · Platforms: Windows

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (1)

T1564.004 Hide Artifacts: NTFS File Attributes

title: "T1564.004 Hide Artifacts: NTFS File Attributes"
id: e7948663-962d-419e-9f41-a2754f9a8fdf
description: 'Detection Strategy for NTFS File Attribute Abuse (ADS/EAs) via creation of non-standard alternate data streams. (Data Component: File Creation (Stream); baseline tier: windows-eventid.) Tune using: ADSPathWhitelist, ProcessScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1564/004
author: Shahrukh Khan
date: 2026-01-21
license: MIT
tags:
  - attack.stealth
  - attack.t1564.004

logsource:
  category: create_stream_hash
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 15
    TargetFilename|contains: ':'

  filter_zoneidentifier:
    TargetFilename|endswith: ':Zone.Identifier'

  condition: selection and not filter_zoneidentifier

falsepositives:
  - Zone.Identifier streams that Windows/browsers automatically attach to files downloaded from the internet are excluded.

level: medium

Related sub-techniques

Explore