Threat intelligence / Mitigation

NTFS File Attributes Mitigation

It may be difficult or inadvisable to block access to EA and ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Symantec ADS May 2009) Efforts should be focused on preventing potentially malicious software from running. Identify and block potentially malicious software that may contain functionality to hide information in EA and ADSs by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP) Consider adjusting read and write permissions for NTFS EA, though this should be tested to ensure routine OS operations are not impeded. (Citation: InsiderThreat NTFS EA Oct 2017)

Mitigation

TypeMitigation

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

It may be difficult or inadvisable to block access to EA and ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Symantec ADS May 2009) Efforts should be focused on preventing potentially malicious software from running. Identify and block potentially malicious software that may contain functionality to hide information in EA and ADSs by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP) Consider adjusting read and write permissions for NTFS EA, though this should be tested to ensure routine OS operations are not impeded. (Citation: InsiderThreat NTFS EA Oct 2017)

0 recorded

Relationships

No relationships recorded.

9 external

References

mitre-attack

T1096

Microsoft ADS Mar 2014

https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/

Symantec ADS May 2009

https://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows-your-data-secure-can-you-restore

Beechey 2010

http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599

Windows Commands JPCERT

https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html

NSA MS AppLocker

https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm

Corio 2008

http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx

TechNet Applocker vs SRP

https://technet.microsoft.com/en-us/library/ee791851.aspx

InsiderThreat NTFS EA Oct 2017

https://blog.stealthbits.com/attack-step-3-persistence-ntfs-extended-attributes-file-system-attacks