streams.exe

  • File Path: C:\SysinternalsSuite\streams.exe
  • Description: Reveal NTFS alternate streams.

Hashes

Type Hash
MD5 AAF553D0591FC515265078B4FF6EE8D2
SHA1 9C4603BA02CF751B583549CB12AC83D5A37117A4
SHA256 F0E8BDBF4F75C13FA55EB983CA9380CE5DA0AC0FDC9A8F02D82446FAB664FE96
SHA384 2E4C19F442D28A4E61504C87EA7E5DDBD4D72AF6C8E5DDDF07A71758AEDF66D1A33D7AF8DAAC6F27FC2BCF49CA6645FD
SHA512 96D6DC304F63645BA8168E685E67C8DD4DD3F04BA5F9B5349DF55EA5E73A1A2D2D019F2E700A09ABBFCA26C961F69C3705F8E09147751A2F472C5555776D6DC0
SSDEEP 6144:yhPMSaYYSc1036t3p30RZlfTvWX6dGjxJLzk0vJ:WhaXSc10qt53mZkqVU
IMP 2BBED49DEAAC0A22468BEB62FDFCAAAE
PESHA1 38A47B52623E2F2FAE42E4C7D0A0EE788C347A9F
PE256 BC43DD8B23F3A2635DD24F9BA798871BEC9B570956FFF8E2580E29426A42448F

Runtime Data

Usage (stdout):


streams v1.60 - Reveal NTFS alternate streams.
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

usage: C:\SysinternalsSuite\streams.exe [-s] [-d] <file or directory>
-s     Recurse subdirectories
-d     Delete streams
-nobanner
       Do not display the startup banner and copyright message.

Loaded Modules:

Path
C:\SysinternalsSuite\streams.exe
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000187721772155940C709000000000187
  • Thumbprint: 2485A7AFA98E178CB8F30C9838346B514AEA4769
  • Issuer: CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: streams.exe
  • Product Name: Sysinternals Streams
  • Company Name: Sysinternals - www.sysinternals.com
  • File Version: 1.60
  • Product Version: 1.60
  • Language: English (United States)
  • Legal Copyright: Copyright (C) 2005-2016 Mark Russinovich
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/71
  • VirusTotal Link: https://www.virustotal.com/gui/file/f0e8bdbf4f75c13fa55eb983ca9380ce5da0ac0fdc9a8f02d82446fab664fe96/detection/

Possible Misuse

The following table contains possible examples of streams.exe being misused. While streams.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma sysmon_rclone_execution.yml - '--multi-thread-streams' DRL 1.0
sigma posh_ps_ntfs_ads_access.yml description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging. DRL 1.0
sigma proc_creation_win_alternate_data_streams.yml title: Execute From Alternate Data Streams DRL 1.0
sigma proc_creation_win_false_sysinternalsuite.yml - '\streams.exe' DRL 1.0
sigma proc_creation_win_susp_findstr.yml - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/ DRL 1.0
sigma proc_creation_win_susp_rclone_execution.yml - 'multi-thread-streams' DRL 1.0
LOLBAS Cmd.yml - IOC: cmd.exe executing files from alternate data streams.  
LOLBAS ConfigSecurityPolicy.yml - IOC: ConfigSecurityPolicy storing data into alternate data streams.  
LOLBAS Control.yml - IOC: Control.exe executing files from alternate data streams  
LOLBAS Cscript.yml - IOC: Cscript.exe executing files from alternate data streams  
LOLBAS Cscript.yml - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/  
LOLBAS Diantz.yml - IOC: diantz storing data into alternate data streams.  
LOLBAS Esentutl.yml Usecase: Extract hidden file within alternate data streams  
LOLBAS Extrac32.yml - Link: https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/  
LOLBAS Findstr.yml - Link: https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/  
LOLBAS Forfiles.yml - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/  
LOLBAS Makecab.yml - IOC: Makecab storing data into alternate data streams  
LOLBAS Mavinject.yml - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/  
LOLBAS MpCmdRun.yml - IOC: MpCmdRun storing data into alternate data streams.  
LOLBAS Mshta.yml - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/  
LOLBAS Rundll32.yml - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/  
LOLBAS Sc.yml - Link: https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/  
LOLBAS Wmic.yml Usecase: Execute binary file hidden in Alternate data streams to evade defensive counter measures  
LOLBAS Wscript.yml - IOC: Wscript.exe executing code from alternate data streams  
atomic-red-team index.md - Atomic Test #1: Alternate Data Streams (ADS) [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: Alternate Data Streams (ADS) [windows] MIT License. © 2018 Red Canary
atomic-red-team T1553.005.md Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1564.004.md <blockquote>Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014) MIT License. © 2018 Red Canary
atomic-red-team T1564.004.md - Atomic Test #1 - Alternate Data Streams (ADS) MIT License. © 2018 Red Canary
atomic-red-team T1564.004.md ## Atomic Test #1 - Alternate Data Streams (ADS) MIT License. © 2018 Red Canary
atomic-red-team T1564.004.md Execute from Alternate Streams MIT License. © 2018 Red Canary
atomic-red-team T1564.004.md Reference - 2 MIT License. © 2018 Red Canary
atomic-red-team T1564.004.md in the %temp% direcotry to view all files with hidden data streams. To view the data in the alternate data stream, run “notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt” in the %temp% folder. MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.