| splunk |
Windows Wermgr Alternate Data Stream in Temp Dir |
production |
2026-10-12 |
| splunk |
Windows Alternate Data Stream Created Over Local Share |
production |
2026-09-30 |
| elastic |
Potential Evasion via Boot Time Removal Tool |
production |
2026-09-18 |
| elastic |
Alternate Data Stream Creation/Execution at Volume Root Directory |
production |
2026-09-18 |
| elastic |
Unusual File Creation - Alternate Data Stream |
production |
2026-09-18 |
| elastic |
Unusual Process Execution Path - Alternate Data Stream |
production |
2026-09-18 |
| splunk |
Windows Alternate DataStream - Process Execution |
production |
2026-06-04 |
| splunk |
Windows Alternate DataStream - Executable Content |
production |
2026-05-13 |
| splunk |
Windows SymbolicLink-Testing-Tools Utility Execution |
production |
2026-05-13 |
| splunk |
Windows Alternate DataStream - Base64 Content |
production |
2026-05-13 |
| sigma |
Unusual File Download From File Sharing Websites - File Stream |
test |
2026-03-29 |
| sigma |
Suspicious File Download From File Sharing Websites - File Stream |
test |
2026-03-29 |
| sigma |
Potential Rundll32 Execution With DLL Stored In ADS |
test |
2026-03-16 |
| sigma |
Use Short Name Path in Command Line |
test |
2025-10-22 |
| sigma |
Use Short Name Path in Image |
test |
2025-10-20 |
| sigma |
HackTool Named File Stream Created |
test |
2024-11-23 |
| sigma |
Hidden Flag Set On File/Directory Via Chflags - MacOS |
test |
2024-08-21 |
| sigma |
Insensitive Subfolder Search Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
Remote File Download Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream |
test |
2023-10-09 |
| sigma |
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI |
test |
2023-10-09 |
| sigma |
Use NTFS Short Name in Image |
test |
2023-07-20 |
| sigma |
Unusual File Download from Direct IP Address |
test |
2023-02-10 |
| sigma |
Hidden Executable In NTFS Alternate Data Stream |
test |
2023-02-10 |
| sigma |
Suspicious Diantz Alternate Data Stream Execution |
test |
2022-12-31 |
| sigma |
Suspicious Extrac32 Alternate Data Stream Execution |
test |
2022-12-30 |
| sigma |
Powershell Store File In Alternate Data Stream |
test |
2022-12-25 |
| sigma |
NTFS Alternate Data Stream |
test |
2022-12-25 |
| sigma |
Execute From Alternate Data Streams |
test |
2022-10-09 |
| sigma |
Use NTFS Short Name in Command Line |
test |
2022-09-21 |
| sigma |
Run PowerShell Script from ADS |
test |
2022-07-14 |
| sigma |
PrintBrm ZIP Creation of Extraction |
test |
2022-05-02 |
| sigma |
Exports Registry Key To an Alternate Data Stream |
test |
2021-11-27 |