How can special Alternative Data Streams (ADS) bypass conventional detection tools like ADSCheck.exe and streams.exe?

Special ADS created with unusual filenames such as `...` (three dots), COM device names (e.g., `COM1`), or the disk root (`C:\`) are not listed by `dir /r` or detected by tools like ADSCheck.exe and streams.exe. For example, using `type putty.exe > ...:putty.exe` hides the ADS entirely from these scanners. These special names exploit Windows naming conventions to evade discovery, as detailed in the [article](/news/advanced-exploitation-techniques-for-hidden-alternative-data-streams).