One Day Sec

How can special Alternative Data Streams (ADS) bypass conventional detection tools like ADSCheck.exe and streams.exe?

Special ADS created with unusual filenames such as `...` (three dots), COM device names (e.g., `COM1`), or the disk root (`C:\`) are not listed by `dir /r` or detected by tools like ADSCheck.exe and streams.exe. For example, using `type putty.exe > ...:putty.exe` hides the ADS entirely from these scanners. These special names exploit Windows naming conventions to evade discovery, as detailed in the article.
ADS detection bypassspecial filenamesCOM device namesdisk root ADSADSCheckstreams.exe

Browse all Q&A →