#AlternateDataStreams - Twitter Hashtag

over 6 years ago

This simple regex will find most of these ADS strings (provided by @odvarmoe) in commandline logs (e.g. EventID 4688) egrep ".*\..{3}:.*" #lolbins #AlternateDataStreams #DFIR #ThreatHunting

DFIR_TNT @DFIR_TNT

over 6 years ago

If you are logging command execution, check out these examples of abusing "Alternate Data Streams" and think about how to detect! #DFIR #threathunting #blueteam https://t.co/K3WB2pwWcV

0

7

2

0

1

11

1

2

0

Security Onion

@securityonion

over 6 years ago

We also have a bonus use case which shows #Sysmon 11.10 #FileCreateStreamHash events and their support for #MarkOfTheWeb via #AlternateDataStreams: https://t.co/AK0aNuID1k Thanks to @markrussinovich for this great feature! #ThreatHunting #DFIR #SecurityOnion

1

11

4

1

0

Adrian Denkiewicz @a_denkiewicz

about 7 years ago

I wrote a piece on #NTFS's #AlternateDataStreams, the internals and quirks. Did you know that you can transfer streams in WIM archives or create impossible to delete files? Or that Zone.Identifier may leak referrer URL? Find out more: https://t.co/VQzGipCD1f @CQUREAcademy

0

5

3

2

0

marc ochsenmeier @ochsenmeier

about 8 years ago

looking at Windows #AlternateDataStreams on Win10 > Start a sysinternals tool hidden in a stream with an App from the Store!? @Microsoft @markrussinovich

ochsenmeier's tweet photo. looking at Windows #AlternateDataStreams on Win10 > Start a sysinternals tool hidden in a stream with an App from the Store!? @Microsoft @markrussinovich https://t.co/oQen0LZ88a

1

20

7

1

0

Top Tweets for #AlternateDataStreams

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users