PowerShell reading or writing an alternate data stream by name

Siemphony@siemphonymediumT1564.004unverifiedPlaybook · Defence evasion

AN1206 names three concrete signals — colon syntax in a file path, ZwSetEaFile/ZwQueryEaFile API calls, and "PowerShell/Windows utilities interacting with -stream parameters" — and only the last is observable as a literal token in a single event. The colon-syntax signal (file.ext:ads) is not a usable Sigma filter on this brief's create_stream_hash source: Sysmon EventID 15 fires only for named-stream creation, so TargetFilename already contains a colon on every event in that category by definition, and the two existing corpus rules against non-Zone.Identifier-stream siblings of this technique (T1027.006, T1204.002) already cover the Zone.Identifier-specific case. The EA API calls have no Sigma-visible logsource in this brief at all. So this rule instead matches process_creation where powershell.exe or pwsh.exe is invoked with the -Stream parameter, which every stream-aware cmdlet — Get-Content, Set-Content, Add-Content, Get-Item, Remove-Item — accepts identically to name the alternate stream it targets, whether reading a hidden payload out or writing one in. It cannot tell a read from a write, or a malicious stream name from a legitimate one, from the command line alone. Sysmon EventID 1 must be enabled and capturing CommandLine, which is the default when Sysmon is installed at all (unlike Security 4688, this source needs no separate audit policy for command-line capture). UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0432, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: PowerShell reading or writing an alternate data stream by name2id: 621ab722-5c86-4d5c-bed4-2832be06d7f23status: experimental4description: |5  AN1206 names three concrete signals — colon syntax in a file path,6  ZwSetEaFile/ZwQueryEaFile API calls, and "PowerShell/Windows utilities7  interacting with -stream parameters" — and only the last is observable as a8  literal token in a single event. The colon-syntax signal (file.ext:ads) is9  not a usable Sigma filter on this brief's create_stream_hash source: Sysmon10  EventID 15 fires only for named-stream creation, so TargetFilename already11  contains a colon on every event in that category by definition, and the two12  existing corpus rules against non-Zone.Identifier-stream siblings of this13  technique (T1027.006, T1204.002) already cover the Zone.Identifier-specific14  case. The EA API calls have no Sigma-visible logsource in this brief at15  all. So this rule instead matches process_creation where powershell.exe or16  pwsh.exe is invoked with the -Stream parameter, which every stream-aware17  cmdlet — Get-Content, Set-Content, Add-Content, Get-Item, Remove-Item —18  accepts identically to name the alternate stream it targets, whether19  reading a hidden payload out or writing one in. It cannot tell a read from20  a write, or a malicious stream name from a legitimate one, from the command21  line alone. Sysmon EventID 1 must be enabled and capturing CommandLine,22  which is the default when Sysmon is installed at all (unlike Security 4688,23  this source needs no separate audit policy for command-line capture).24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0432, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T1564/00427  - https://attack.mitre.org/detectionstrategies/DET043228author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1730tags:31  - attack.defense-evasion32  - attack.t1564.00433logsource:34  category: process_creation35  product: windows36detection:37  selection_tool:38    Image|endswith:39      - '\powershell.exe'40      - '\pwsh.exe'41  selection_stream_flag:42    CommandLine|contains|windash: '-stream'43  condition: selection_tool and selection_stream_flag44falsepositives:45  - "Security and IT scripts that check or strip the Zone.Identifier MOTW tag using Get-Item -Stream Zone.Identifier or a hand-rolled Unblock-File equivalent built on Get-Content/Remove-Item -Stream — the single most common legitimate reason to type -Stream on a Windows host, and indistinguishable here from a malicious write."46  - "Backup, forensic and file-integrity tools written in PowerShell that enumerate every alternate data stream on a fileset with Get-Item -Stream * as part of routine auditing, which is the same flag this rule watches for."47  - "Document-management, compliance and file-tagging products that store custom metadata in a named alternate stream through a PowerShell wrapper around Set-Content or Add-Content -Stream — a legitimate, intentional use of the exact same parameter this rule watches for."48level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "-stream" or ProcessCommandLine contains "/stream" or ProcessCommandLine contains "–stream" or ProcessCommandLine contains "—stream" or ProcessCommandLine contains "―stream"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*-stream*" OR CommandLine="*/stream*" OR CommandLine="*–stream*" OR CommandLine="*—stream*" OR CommandLine="*―stream*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*-stream*" OR TO_LOWER(process.command_line) LIKE "*/stream*" OR TO_LOWER(process.command_line) LIKE "*–stream*" OR TO_LOWER(process.command_line) LIKE "*—stream*" OR TO_LOWER(process.command_line) LIKE "*―stream*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(-stream|/stream|–stream|—stream|―stream)</field>    <description>PowerShell reading or writing an alternate data stream by name</description>    <mitre>      <id>T1564.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: hide_artifacts
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 621ab722-5c86-4d5c-bed4-2832be06d7f2

ATT&CKT1564.004

T1564.004NTFS File Attributes

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1564.004, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names three knobs on AN1206. ADSPathWhitelist — excluding legitimate ADS usage by system or AV tools — is the natural fit for suppressing the MOTW-stripping and backup-tool noise above, but it needs a real inventory of which tools and stream names are expected in your environment; nothing in this brief supplies one. ProcessScope — restricting to suspicious parent processes such as powershell.exe, cmd.exe, or wscript.exe — is already partly applied by scoping the tool selector to PowerShell itself. TimeWindow, correlating ADS creation with subsequent process execution, belongs to a correlation this single-event rule cannot express.

Declared by the author

Security and IT scripts that check or strip the Zone.Identifier MOTW tag using Get-Item -Stream Zone.Identifier or a hand-rolled Unblock-File equivalent built on Get-Content/Remove-Item -Stream — the single most common legitimate reason to type -Stream on a Windows host, and indistinguishable here from a malicious write.
Backup, forensic and file-integrity tools written in PowerShell that enumerate every alternate data stream on a fileset with Get-Item -Stream * as part of routine auditing, which is the same flag this rule watches for.
Document-management, compliance and file-tagging products that store custom metadata in a named alternate stream through a PowerShell wrapper around Set-Content or Add-Content -Stream — a legitimate, intentional use of the exact same parameter this rule watches for.

Lessonhide artifacts

hide artifactsAI draft — unreviewed

01 · What this rule detects

AN1206 names three concrete signals: colon syntax in a file path (file.ext:ads), the ZwSetEaFile/ZwQueryEaFile API calls, and "PowerShell/Windows utilities interacting with -stream parameters." Only the last is observable as a literal token in a single event on this brief. The colon-syntax signal isn't a usable filter against the brief's create_stream_hash source, since Sysmon EventID 15 fires only for named-stream creation and TargetFilename already contains a colon on every event in that category by definition — it can't distinguish this technique from a Zone.Identifier write, which two existing corpus rules (T1027.006, T1204.002) already cover. The EA API calls have no Sigma-visible logsource anywhere in this brief. So this rule instead matches process creation where PowerShell is invoked with the -Stream parameter — the one signal that survives as a single, literal event.

02 · Telemetry you need

Sysmon EventID 1 (process_creation) with CommandLine capture. This is the default the moment Sysmon is installed at all, unlike Security 4688, which needs a separate audit policy for command-line capture — no extra configuration step here.

03 · How the logic works

Two blocks, ANDed. selection_tool matches Image ending in \powershell.exe or \pwsh.exe. selection_stream_flag matches CommandLine containing -stream, using the windash modifier so both dash and slash-prefixed forms are caught. Every stream-aware PowerShell cmdlet — Get-Content, Set-Content, Add-Content, Get-Item, Remove-Item — accepts -Stream identically to name the alternate data stream it targets, whether reading a hidden payload out or writing one in. The rule cannot distinguish a read from a write, or a malicious stream name from a legitimate one, from the command line alone — it only sees that the parameter was used.

04 · Common false positives

-Stream is a general-purpose PowerShell parameter with routine legitimate uses, not an attacker-specific flag. Three named false-positive sources: security and IT scripts checking or stripping the Zone.Identifier MOTW tag via Get-Item -Stream Zone.Identifier or a hand-rolled Unblock-File equivalent — likely the single most common legitimate reason to type -Stream on a Windows host, and indistinguishable here from a malicious write; backup, forensic, and file-integrity tools enumerating every alternate stream on a fileset with Get-Item -Stream * as routine auditing; and document-management or compliance products storing custom metadata in a named stream through a PowerShell wrapper around Set-Content/Add-Content -Stream. Level is medium, reflecting that the flag is specific enough to be meaningful but common enough in legitimate tooling to need context before acting on it.

05 · Detection maturity

tier_1: Lowest DeBMM tier: authored from MITRE's prose, never run against a log line. It stays there until it has fired against real EventID 1 telemetry and the ratio of MOTW-stripping and backup-tool hits to anything else has actually been measured.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/621ab722-5c86-4d5c-bed4-2832be06d7f2

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell reading or writing an alternate data stream by name

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it