di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Storage

Prevention for Applications

Prevention for Endpoints

Data Security: Powered by Deep Instinct

Deep Learning: Prevention-First Cybersecurity

Products

>99% Threat Accuracy

Prevent Ransomware

Prevent Zero-Day Attacks

Why Deep Instinct

Extend & Enhance EDR/XDR

+ Microsoft Defender

+ Tanium

Legacy AV

Enhance Existing Cyber Tools

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Events & Webinars

Resources

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick links

EXPLORE THE PREDICTIVE PREVENTION PLATFORM

End-to-end predictive prevention platform built on a deep learning framework that protects storage, applications, and endpoints.

Prevent >99% of zero-day exploits, ransomware, and unknown threats in your NAS and cloud storage repositories.

Proactively prevent malicious files from entering your storage environment through application uploads by customers, employees, and third parties.

Prevent known and unknown malware, zero-day exploits, ransomware, and script-based attacks before they execute on the endpoint – faster than a blink of an eye.

Leverage advanced predictive prevention technology to protect data across your entire environment.

Data Security: Powered By Deep Instinct

Deep Instinct is the only deep learning framework in the world built from the ground up for cybersecurity.

Unparalleled Prevention

Leverage deep learning to deliver highly accurate threat detection and reduce false positives in a rapidly evolving threat landscape.

Stop threats using real-time classification and prevention techniques to ensure robust and efficient cybersecurity.

Proactively stop zero-day threats in <20ms with unparalleled accuracy and minimal false positives.

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ MICROSOFT DEFENDER

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ TANIUM

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

LEGACY AV

Threat Research

Voice Of SecOps

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

The following blog post presents the concept of Alternate Data Stream and how it has been used in the wild, in the past as well as these days: as a te

Alternate_data_stream830x569.jpg

The following blog post presents the concept of Alternate Data Stream and how it has been used in the wild, in the past as well as these days: as a technique used to hide a malicious payload in the file system. Although it might be considered an old technique, it is still relevant today and common in the wild.<h2>What is an Alternate Data Stream?</h2>Alternate Data Stream (ADS) is the ability of an NTFS file system (the main file system format in Windows) to store different streams of data, in addition to the default stream which is normally used for a file. When this feature was created, its main purpose was to provide support to the macOS <a href="https://en.wikipedia.org/wiki/Hierarchical_File_System" target="_blank" rel="noopener noreferrer">Hierarchical File System</a> (HFS).The NTFS file system contains files with attributes. The relevant attribute for our scope is the $DATA attribute, which is used to store the data streams of a file.In the past, it was common to store a malicious payload within an ADS of a legitimate file. But today, many security solutions will detect and scan ADSs’. However, we will show you in this post, an ADS can still be used to run payloads while being hidden from the user as well as various security products.To simplify the concepts that are presented in this article, all the examples are based on native tools in Windows.<h2>How to Use ADS</h2>In the good old days of Windows Vista, Alternate Data Streams (ADS) was a common method for malware developers to hide their malicious code. An alternate Data Stream was effectively used to his the presence of malicious corrupting files, by squeezing it inside a legitimate file. &nbsp;By putting malware in the Alternate Data Stream, the Windows file would contain information and directions for the legitimate files, but also for the malicious file. In order to run the malicious code the hacker has deposited in the Alternate Data Stream, s/he would want to create a symlink using the mklink command. But doing this necessitates having administrative rights on the machine. Considering the normal behavior of a user doesn’t require running operating as an admin, hackers tend to approach their targets assuming that they land on a box without any admin rights.Enumeration - The mainstream under $DATA is the empty string (thus: “”, also called the unnamed stream). This stream is used to contain the regular stream of a file.The following is an example of enumerating the data streams of a file with PowerShell:<img class="alignnone size-full wp-image-1866" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5e349199b0283742/611a82e38d53e815d5044f97/w.png" width="838" height="105" style="width: 838px; height: 105px;"/>You can also use dir /R, or SysInternals\streams.exe to enumerate an ADS of a file / recursively on a directoryAs you can see above, the file only contains the unnamed stream.However, sometimes you can find an ADS within a legitimate file, as there are several legitimate uses for this technique.Below is an example of enumerating data streams of a file with an ADS with PowerShell:<img class="alignnone size-full wp-image-1867" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcac97e4608fadee8/611a82e39874b81619df297a/w2.png" width="840" height="132" style="width: 840px; height: 132px;"/> This is also an example of a legitimate use of ADS: the Zone. Identifier. This field presents the trust level of the file’s source. This is a browsers’ usage to store the Its macOS corresponding is the “quarantine bit”.Creation - While there can be legitimate uses for ADS, ADS can also be used to store a malicious payload. Attackers might prefer this method over saving the payload in the unnamed stream, because its presence will be hidden from the user – it is not accessible from explorer.exe (and the displayed size of a file does not include ADS’s size). In addition, it is not displayed by default with the “dir” command (however, /R flag displays ADS, and is applied from Windows Vista).Creating an ADS is quite simple.An example of creating an ADS with type command:<img class="alignnone size-full wp-image-1868" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf5d29629e4fd14f3/611a82e29e3e001656bdea92/w3.png" width="589" height="37" style="width: 589px; height: 37px;"/>Until Windows XP, it was possible to run an ADS with the start command. However, since later versions of Windows, it is no longer possible.Data Access - Abusing ADS is still a relevant threat, as there are multiple ways to read and execute an ADS.The first usage is accessing the data. The content of the ADS can be accessed easily. The following is an example with PowerShell:<img class="alignnone size-full wp-image-1869" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt32765446b44bfab5/611a82e2aa5dd6163af598af/w4.png" width="838" height="113" style="width: 838px; height: 113px;"/>Execution - In addition to reading the data, it is also possible to execute it. Although it’s not possible to execute an ADS with “start” command, it can still be run from other programs. For example, with WMI:“wmic process call creates” – runs a process with WMI. It can also run an ADS. Example:<img class="alignnone size-full wp-image-1870" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf38b881529dd2761/611a82d53ad228160f2ddf87/w5.png" width="625" height="366" style="width: 625px; height: 366px;"/>There are additional legitimate native tools of Windows that can be used to directly run an ADS. For example, a DLL can be saved inside an ADS and called by DllMain through rundll32.exe; also, an HTA can be saved inside an ADS and called through mshta.exe; and so on.<h2>Malicious Campaigns Abusing ADS</h2>It may seem that Windows has managed to handle the threats that reside within ADS. However, there are many malware families in the wild that still abuse ADS’s.<a href="https://nakedsecurity.sophos.com/2017/09/21/how-bitpaymer-ransomware-covers-its-tracks/" target="_blank" rel="noopener noreferrer">Another example from 2017 is BitPaymer</a>, ransomware which used two ADS’s in the attack sequence, in order to add stealth to the actions and hide malicious activity. The first ADS was created in order to run the “net view” command to obtain network shares, then the second ADS scrambles the data on the disk and network shares.To conclude, abusing ADS is a technique that is still relevant nowadays. Indeed, recent Windows versions have limited and hardened the functionality of ADS. However, basic command of native Windows tools such as Power-Shell and WMI, or some knowledge of Windows command-line allows threat actors to continue and leverage ADS in their attacks. Interestingly, recent campaigns using ADS are considered rather sophisticated and tend to minimize the use of persistent files on disk.<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5" target="_blank"><img id="hs-cta-img-9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5" class="hs-cta-img" style="width: 800px; height: 200px;" src="https://no-cache.hubspot.com/cta/default/2183098/9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5.png" alt="New call-to-action" width="800" height="200"/></a>

The Abuse of Alternate Data Stream Hasn't Disappeared

Announcing Deep Instinct Prevention for Storage for cloud storage and NAS environments