Alternate Data Streams: The NTFS Feature Attackers Hide In

Every file on an NTFS volume has an unnamed data stream — the bytes you see when you open it. What most defenders forget is that NTFS also lets any file carry additional named streams, called Alternate Data Streams (ADS). These streams are invisible in Explorer, ignored by most file-size totals, and preserved silently as long as the file stays on NTFS. Windows itself uses them for legitimate metadata. Attackers use them to hide.

What an ADS actually is

A stream is addressed with the syntax filename:streamname. The primary content lives in the default $DATA stream (file.txt::$DATA); anything else is alternate. You can write one from a stock shell with no special tooling:

echo malicious content > report.docx:hidden.txt
type c:\payload.exe > notes.txt:calc.exe
dir /r                       ':' streams show only with /r
Get-Item notes.txt -Stream *  # PowerShell enumerates every stream

Note that report.docx keeps its original size and modification time. Copy it to a FAT/exFAT drive or attach it to email and the hidden stream is stripped — which is exactly why ADS is a local hiding technique, not a delivery one.

Zone.Identifier: the stream you already rely on

The most common ADS in the wild is benign. When you download a file, Windows attaches a Zone.Identifier stream — the Mark-of-the-Web (MOTW). SmartScreen, Office Protected View, and macro-blocking all key off it:

Get-Content .\installer.exe -Stream Zone.Identifier
# [ZoneTransfer]
# ZoneId=3          (3 = Internet)
# ReferrerUrl=...
# HostUrl=...

Attackers care about this stream for the opposite reason: stripping it removes the security prompt. Delivering a payload inside a container format that doesn't propagate MOTW to its contents (older ISO/IMG mounts, some archive tools, 7-Zip prior to hardening) means the extracted executable arrives with no Zone.Identifier and SmartScreen never fires. This is the mechanism behind years of ISO-smuggling campaigns.

How the technique gets weaponized

• Payload storage. A dropper hides a second-stage binary in c:\windows\temp\log.txt:svc.exe, keeping the visible file an innocuous log.
• Execution. Historically wmic process call create, rundll32, and forfiles could launch code directly from a stream. Modern Windows blocks direct start of a stream, but scripting hosts (wscript, powershell -EncodedCommand reading a stream) still run stream contents fine.
• MOTW evasion. Removing or never-writing Zone.Identifier to defeat SmartScreen and Office macro policy.
• Data staging. Exfil tooling parks collected data in a stream on a routine file so a casual folder review shows nothing unusual.

ADS abuse maps to MITRE ATT&CK T1564.004 (Hide Artifacts: NTFS File Attributes). It is a defense-evasion primitive, not an exploit — which is precisely why signature-based AV so often walks right past it.

Why it slips past the usual controls

Directory listings, backup size reports, and many EDR file-write hooks only inspect the default stream. Antivirus engines scan on-access, but if nothing executes the stream directly, the bytes may never trigger a scan. And because Windows legitimately creates thousands of Zone.Identifier streams, blunt "alert on any ADS" rules drown in noise. The signal is in the anomalous stream: an executable-sized stream on a text file, a stream named to look like a stream that shouldn't exist, or a sensitive download that is missing its expected MOTW.

Hunting ADS by hand

# Every non-default stream under a path, with sizes
Get-ChildItem C:\Users -Recurse -File -ErrorAction SilentlyContinue |
  ForEach-Object { Get-Item $_.FullName -Stream * -ErrorAction SilentlyContinue } |
  Where-Object { $_.Stream -ne ':$DATA' -and $_.Stream -ne 'Zone.Identifier' } |
  Select-Object FileName, Stream, Length

# Read a suspicious stream without executing it
Get-Content .\notes.txt -Stream calc.exe -Raw

# Remove a stream once triaged
Remove-Item .\notes.txt -Stream calc.exe

Sysinternals streams.exe -s does the same recursively and is handy for a one-off sweep.

How WinSentinel surfaces it

WinSentinel treats alternate data streams as a first-class artifact rather than a footnote. Its NTFS and persistence audits enumerate non-default streams across user profiles, temp directories, and startup locations, then score them by anomaly, not mere presence — a hidden PE-sized stream on a document is flagged; a routine Zone.Identifier is not. It correlates missing MOTW on recently downloaded executables with SmartScreen posture, so an ISO-smuggled binary that arrived without a zone marker stands out. Every finding lands in the same risk-scored report as the rest of the host's posture, with the exact file, stream name, and remediation command.

On a single machine this runs at full power for free — all 33 modules, every stream on the box, no limits. When you're responsible for a fleet, WinSentinel Pro rolls those per-host ADS findings up to a central node: you see which of your 50 or 500 endpoints have anomalous streams, get drift alerts when new hidden streams appear, and fold the results into compliance reporting instead of chasing them one desktop at a time.

Practical hardening

1. Keep SmartScreen and Office Block macros from the internet enabled — they depend on MOTW, so preserve the zone marker end-to-end.
2. Configure archive tools and mount policies so MOTW propagates to extracted contents; block or gate ISO/IMG auto-mount where you can.
3. Baseline expected streams and alert on new executable-sized ADS in temp, profile, and startup paths.
4. Run a recurring ADS sweep — manual for one box, automated and centralized for a fleet.

Alternate data streams aren't a bug; they're a decades-old NTFS feature that quietly rewards whoever is paying attention. Make sure that's you, not the intruder.