Alternate Data Streams

Classification: Host & Network Penetration Testing / System & Host-Based Attacks
Target: Windows host (local file system, C:\Temp)
Technique: NTFS Alternate Data Streams (ADS) for hiding an executable

1. Executive Summary

NTFS Alternate Data Streams let a file carry hidden secondary streams that don’t show up in Explorer or a normal directory listing. Here we hide the WinPEAS privilege-escalation executable inside the ADS of a harmless windowslog.txt, delete the original payload, and then execute the hidden stream through a symbolic link (wupdate.exe), since ADS binaries cannot be launched directly by path.

2. Staging the Payload

The payload (WinPEAS) is dropped to C:\Temp.

$payload.exe in C:\Temp$

3. Hiding the Executable in an ADS

Piping the executable into an alternate data stream of a text file.

type payload.exe > windowslog.txt:winpeas.exe

Hiding payload in windowslog.txt ADS

Explorer now shows only windowslog.txt (reported as 0 KB) — the executable is concealed in the stream.

windowslog.txt appears as a normal text file

4. Confirming the Cover File & Removing the Original

Opening windowslog.txt shows ordinary text content, so it looks benign.

windowslog.txt opens as a normal text file

The original payload.exe is deleted — only the hidden stream remains.

Deleting the original payload

5. Executing the Hidden Stream

A stream can’t be opened/launched directly — Windows refuses it.

notepad windowslog.txt:winpeas.exe      # no program associated
start windowslog.txt:winpeas.exe        # Access is denied

No program associated error

start — Access is denied

6. Symbolic Link Workaround

Creating a symbolic link to the ADS lets us invoke it by a normal name. This requires an elevated prompt (mklink needs SeCreateSymbolicLinkPrivilege).

mklink wupdate.exe C:\Temp\windowslog.txt:winpeas.exe

Without elevation it fails:

mklink without privilege — fails

From an elevated command prompt the link is created:

symbolic link created for wupdate.exe <<===>> C:\Temp\windowslog.txt:winpeas.exe

mklink succeeds in elevated prompt

7. Running the Hidden Executable

Now typing wupdate anywhere executes the hidden WinPEAS stream.

wupdate

wupdate launches the hidden WinPEAS

8. Remediation Recommendations

Monitor for ADS creation/use — EDR and Sysmon (FileCreateStreamHash) flag writes to file:stream and execution via streams; dir /r and Get-Item -Stream * reveal them.
Application allow-listing (WDAC/AppLocker) to block execution of unapproved binaries, including those reached via symbolic links.
Restrict SeCreateSymbolicLinkPrivilege to administrators only.
Consider non-NTFS or policy controls on sensitive shares where ADS is not needed.