How can special Alternative Data Streams (ADS) bypass conventional detection tools like ADSCheck.exe and streams.exe?
Special ADS created with unusual filenames such as `...` (three dots), COM device names (e.g., `COM1`), or the disk root (`C:\`) are not listed by `dir /r` or detected by tools like ADSCheck.exe and streams.exe. For example, using `type putty.exe > ...:putty.exe` hides the ADS entirely from these scanners. These special names exploit Windows naming conventions to evade discovery, as detailed in the article.
ADS detection bypassspecial filenamesCOM device namesdisk root ADSADSCheckstreams.exe