Hackers Hide with Clever Alternate Data Streams
Source: YouTube · John Hammond · published Apr 2, 2024 · 38:41
The video demonstrates how threat actors use Alternate Data Streams (ADS) in Windows to hide data and achieve persistence, with a focus on a novel technique from the Black Cat/ALPHV ransomware group 8:24-8:38.
Key Takeaways:
• Standard Windows file hiding methods are easily circumvented, while ADS allows hiding data inside other files or directories 0:00-0:27
• The Black Cat/ALPHV ransomware group hid persistence mechanisms in the root of the file system (C:), making them undetectable by standard discovery methods 8:38-8:59
• When ADS is created in the root directory, it doesn't appear when using standard commands like "dir /r" or "get-item -stream *" 12:24-12:52
• This technique requires administrator privileges and involves creating services that execute content from the hidden ADS 15:04-15:14
This clever use of a well-known technique demonstrates how threat actors evolve their methods to evade detection while maintaining persistence on compromised systems.
Sources:
- 0:00-0:27 Introduction to Windows file hiding and ADS
- 8:24-8:59 Black Cat/ALPHV ransomware ADS technique
- 12:24-12:52 Root directory ADS stealth properties
- 15:04-15:14 Privilege requirements for the technique
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
you probably already know that you can hide a file on your Windows computer you just rightclick move into the properties select the checkbox for hidden and there you go the file might disappear but this isn't all that interesting because most folks already know about it and it's pretty easy to just circumvent it hey you can find and then unhide that file another option that's a bit more interesting is using alternate data streams where you can still hide a file or data whatever you want inside of a another file and that is less obvious but it's a little cutesy hey a lot of researchers and folks in the cyber security scene acknowledge oh it's a little trinket it's a little bit of a toy using alternate data streams as a technique has been known for many years and usually it's not all that in…