aol.pm

NTFS File Attributes

Subtechnique · ATTACK:enterprise:T1564.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1564.004",
  "title": "NTFS File Attributes",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1564/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f2857333-11d4-45bf-b064-2c28d8525be5",
  "external_id": "T1564.004",
  "domain": "enterprise",
  "created": "2020-03-13T20:33:00.009Z",
  "modified": "2026-05-12T15:12:00.724Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "MalwareBytes ADS July 2015",
      "url": "https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/"
    },
    {
      "source_name": "SpectorOps Host-Based Jul 2017",
      "url": "https://posts.specterops.io/host-based-threat-modeling-indicator-design-a9dbbb53d5ea"
    },
    {
      "source_name": "Journey into IR ZeroAccess NTFS EA",
      "url": "http://journeyintoir.blogspot.com/2012/12/extracting-zeroaccess-from-ntfs.html"
    },
    {
      "source_name": "Microsoft NTFS File Attributes Aug 2010",
      "url": "https://blogs.technet.microsoft.com/askcore/2010/08/25/ntfs-file-attributes/"
    },
    {
      "source_name": "Microsoft ADS Mar 2014",
      "url": "https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/"
    },
    {
      "source_name": "Microsoft File Streams",
      "url": "https://learn.microsoft.com/en-us/windows/win32/fileio/file-streams"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ee44004-6aaa-4b22-934d-4f4ef82cbbd4

Kaspersky Regin

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1eeb08cb-8b06-45a7-bf74-fb8bdaa4b02f

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fdd4a0b-fe6d-4fb1-a6ab-7f5063b6ecc3

Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020

ATTACK:enterprise:S0397 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--328ab5f5-017c-4d4c-ab52-078257e39bd7

ESET LoJax Sept 2018

ATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5181727e-706d-4e57-8a41-628a27e03c6c

LOLBAS Esentutl

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67edd4b3-09f8-47c7-aaf1-6440524c78d4

InsiderThreat NTFS EA Oct 2017

ATTACK:enterprise:S0361 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78775a68-6973-43b1-a3d9-a1c9c93c5a3f

LOLBAS Expand

ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91f59958-db5f-429c-9608-a033ea68486b

Volexity PowerDuke November 2016

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc829687-1a36-46f3-9196-79e62f84d005

Mandiant APT41

ATTACK:enterprise:S0145 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc838675-63af-45c5-9a30-081b5f5ac0d7

Cisco DNSMessenger March 2017

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c18285a0-8c55-4aee-bb60-55b359cdfacb

Elastic Latrodectus May 2024

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3e7ca65-d0b0-43bd-ae13-047c361f3a79

Sentinel Labs WastedLocker July 2020

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c42f802b-394c-4d6f-bc3f-bf039c971cae

Crowdstrike Indrik November 2018

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb11ee03-ac58-417a-a50b-4c3229e226a5

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0168 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2d11e48-91f9-4ebf-82b7-c194c0bee9b5

ESET Gazer Aug 2017

ATTACK:enterprise:T1564.004 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd434e57-9813-4e3f-ac86-f9ddc6313704

ATTACK:enterprise:S0027 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e584ec5f-af99-4d61-8b02-3dbacae4adf4

Ciubotariu 2014

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3f777de-db0e-4bde-b347-9c5727ef6bb7

Cyberreason Anchor December 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.