How do attackers use the Windows ::DATA alternate data stream?

How attackers abuse NTFS alternate data streams

Attackers use the ::DATA stream to store secondary content inside an existing file while leaving the file’s visible contents unchanged. That makes it useful for hiding payloads, stage files, notes, or metadata from a quick directory listing or a casual file open. It is a concealment technique, not a separate file system, so defenders need stream-aware inspection.

One practical reason this works is that many users and tools focus on the main file name and default content, not the additional named stream attached to it. On older or lightly monitored Windows systems, that gap can let suspicious data persist next to ordinary-looking documents, shortcuts, or binaries.

When the stream is used for payload storage, the hidden content can be carried forward until another process reads or executes it. That makes ADS especially useful in post-exploitation workflows where the attacker wants to reduce obvious file-system noise and blend into normal Windows file handling.

Why ADS concealment matters for detection and cleanup

ADS abuse is mainly a visibility problem. If file monitoring, EDR, or investigator triage only validates file names and primary content, an attacker can leave useful material behind without triggering obvious alarms. Stream hiding is often paired with living-off-the-land tradecraft, which is why defenders should review execution paths, file creation, and suspicious use of native utilities in Living off the Land Guide.

It also creates cleanup risk. A file can look harmless after the main content is inspected, while the alternate stream still contains the object that matters operationally. That means remediation needs to consider the full file object, not only the visible body of the file.

If the stream is attached to a file that is widely distributed, copied, or archived, the hidden content may survive long enough to complicate forensic review and incident scoping. For that reason, stream enumeration should be part of verification after suspicious file activity, not only after confirmed malware execution.

What defenders should inspect when they suspect ADS use

Start by checking whether the file path, parent process, and stream name line up with expected behavior. A legitimate document should not usually carry executable-looking hidden content, and a benign utility file should not quietly grow a suspicious secondary stream. Stream-aware review should be part of Windows triage, especially where file writes come from script interpreters, archive tooling, downloaders, or remote access tooling.

Defenders should also compare the file’s main content hash or apparent contents with what the file system reports at the stream level. That is often where the discrepancy appears first. If you only inspect the default stream, you may miss the object that was actually staged for later use.

Where you are already investigating broader adversary behavior, stream inspection can complement the attack-pattern view from MITRE ATT&CK Enterprise Matrix and threat reporting such as CISA cyber threat advisories, because ADS often appears as part of a larger staging, persistence, or execution chain rather than as a standalone event.

Risk and Threat Considerations

ADS hiding raises two distinct problems, first it reduces visibility for defenders, and second it can let an attacker keep payloads close to ordinary files that are already trusted by users or tools. That combination can delay detection, complicate forensic review, and make cleanup incomplete if stream enumeration is omitted.

Failure mechanism: Security tooling or analyst workflow checks only the primary file object, so the hidden stream is never enumerated, scanned, or removed. The attacker keeps a secondary payload or staging artifact attached to an otherwise normal-looking file.

Impact: Malware staging, script material, or attacker notes can persist unnoticed, increasing the chance of later execution, re-use, or missed evidence during incident response.

Practitioner Guidance

What to verify: Confirm whether your scanners, EDR, and incident-response scripts enumerate alternate data stream by default. If they do not, treat that as a coverage gap, not a minor tuning issue.

Decision rule: If a suspicious file is present on an endpoint or file share, inspect the file object at the stream level before concluding it is clean. If the stream contains executable, script, or encoded content, escalate the finding as a likely concealment technique rather than a harmless metadata oddity.

What good looks like: File monitoring catches stream creation, access, and deletion events, and analysts can explain why a hidden stream exists on a given file. Where possible, write detections that flag unexpected stream names on user-facing documents, downloads, and binaries.

Practitioner takeaway: ADS is most dangerous when teams assume the visible file is the whole object, because that assumption lets hidden content survive routine review and weakens both detection and cleanup.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?