How do you detect NTFS alternate data streams?

Detect alternate data streams with Sysmon Event 15 (FileCreateStreamHash), excluding the benign Zone.Identifier and SmartScreen streams so only unusual ones remain, then promote streams with an MZ header, script content or large size to alerts. Add command-line detections for writing to or executing from a file:stream path, and for stripped Zone.Identifier streams. Where Sysmon is absent, run a scheduled hunt with Get-Item -Stream * or dir /r over user-writable folders, and include streams in forensic collection.

Detecting NTFS Alternate Data Streams: Sysmon 15 and Hidden Payloads

NTFS lets one file hold several named data streams. Windows uses them for the Mark-of-the-Web (Zone.Identifier), but an attacker can park payloads, scripts or staged data inside a stream of an innocent file, where default tools do not display it. Detection needs stream-aware telemetry, since standard file listings and many scanners ignore them.

Signals at a Glance

Signal	Where	ATT&CK
Stream created with a name other than Zone.Identifier	Sysmon Event 15	T1564.004
Command line writing to file:stream (type, echo or redirect into a colon path)	Sysmon 1, 4688	T1564.004
Execution from a stream: wmic, rundll32, mshta or a script host pointing at file:stream	Sysmon 1	T1564.004
Stream content with an executable header or script keywords	Sysmon 15 Contents and Hash	T1564.004
Directory enumeration with dir /r or streams.exe during triage	Hunt, DFIR collection	T1564.004

Sysmon Event 15

Sysmon Event ID 15, FileCreateStreamHash, records the stream name, hash and, for small streams, the first bytes of content. Windows creates a Zone.Identifier stream for every downloaded file, so exclude it and log the remainder:

<!-- Sysmon configuration fragment: log every stream except Mark-of-the-Web -->
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <RuleGroup name="ads" groupRelation="or">
      <FileCreateStreamHash onmatch="exclude">
        <TargetFilename condition="end with">:Zone.Identifier</TargetFilename>
        <TargetFilename condition="end with">:SmartScreen</TargetFilename>
        <!-- tune/validate: add reviewed vendor streams, for example from backup agents -->
      </FileCreateStreamHash>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

What remains is small enough to review directly. Promote streams with an executable (MZ) header, script keywords or a large size to alerts, and keep the rest as hunting data.

Command Lines and Disk Hunts

Where Sysmon 15 is not deployed, the command line still shows creation and execution. Pair it with a periodic disk hunt that lists non-standard streams in user-writable locations:

# Enumerate non-standard alternate data streams in user-writable paths
Get-ChildItem -Path C:\Users, C:\ProgramData, C:\Windows\Temp -Recurse -File -Force `
    -ErrorAction SilentlyContinue |
  Get-Item -Stream * -ErrorAction SilentlyContinue |
  Where-Object { $_.Stream -notin ':$DATA', 'Zone.Identifier', 'SmartScreen' } |
  Select-Object FileName, Stream, Length |
  Sort-Object Length -Descending
# tune/validate: run per host at low priority; expect a few legitimate vendor streams.
# From cmd.exe, "dir /r" shows the same data for a single directory.

Alert on process creation that references a colon path to run code, for example wmic process call create, rundll32 file.txt:payload.dll,Entry or mshta against a stream.
Watch for Zone.Identifier being removed: a file with its Mark-of-the-Web stripped after download can indicate preparation to bypass SmartScreen.
Include streams in forensic collection; many imaging and triage tools can enumerate them but must be told to.
Remember that ReFS and FAT do not support streams, so artefacts appear only on NTFS volumes.

Vetted sources

Use the Sysmon FileCreateStreamHash documentation and community Sysmon configurations (SwiftOnSecurity, Olaf Hartong), the SigmaHQ rules for ADS creation and execution, Elastic’s NTFS stream detections, MITRE ATT&CK T1564.004 and the Atomic Red Team ADS tests. Baseline your own environment — antivirus, backup and file-sync products write their own streams.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Sysmon Event 15

Command Lines and Disk Hunts

Build Detections That Fire

Defense Evasion Detection

Detection Hub

Timestomping Detection