Alternate Data Stream Attack Framework to Perform Stealth Attacks on Active Directory Hosts-Reference-Cited by-同舟云学术

Alternate Data Stream Attack Framework to Perform Stealth Attacks on Active Directory Hosts

Published:2022-09-27 Issue:19 Volume:14 Page:12288
ISSN:2071-1050
Container-title:Sustainability
language:en
Short-container-title:Sustainability

Author:

Bhardwaj Akashdeep^ORCID,Kaushik Keshav^ORCID,Maashi Mashael S.^ORCID,Aljebreen Mohammed,Bharany Salil

Abstract

Microsoft’s file system, NTFS, is the most utilised file system by Windows OS versions XP, Vista, 7, and 10. These systems have a little-known file attribute feature known as alternate data streams (ADS) which allows each file in the NTFS file system to have multiple data streams. ADS cannot be removed from the NTFS operating systems. However, the presence of ADS is not inevitably an issue in the OS or file system. Valid instances can be found on systems if scanned and might be valid. Windows OS does not have any in-built tools or applications to determine and remove the presence of existing ADS. This research presents ADSA or alternate data stream attack framework to exploit the alternate data streams and perform cyberattacks on Microsoft operating systems. This research discusses the process of creating and searching alternate data streams with a standard file and an executable binary. The authors executed ADS-hidden executable binary in the ADS. The authors present methods to detect and perform a clean-up by deleting the alternate data stream.

Funder

King Saud University

Publisher

MDPI AG

Subject

Management, Monitoring, Policy and Law,Renewable Energy, Sustainability and the Environment,Geography, Planning and Development,Building and Construction

Link

https://www.mdpi.com/2071-1050/14/19/12288/pdf

Reference46 articles.

1. How to Hide Data in a Secret Text File Compartment. How-To Geek https://www.howtogeek.com/howto/windows-vista/stupid-geek-tricks-hide-data-in-a-secret-text-file-compartment/

2. The Abuse of Alternate Data Streams Hasn’t Disappeared. Deep Instinct https://www.deepinstinct.com/2018/06/12/the-abuse-of-alternate-data-stream-hasnt-disappeared/

3. The Malware Hiding in Your Windows System32 Folder: Certutil and Alternate Data Streams. Inside Out Security https://www.varonis.com/blog/the-malware-hiding-in-your-windows-system32-folder-part-iii-certutil-and-alternate-data-streams/

4. Folder Security Viewer Blog https://blog.foldersecurityviewer.com/how-to-hide-all-ntfs-alternate-data-streams/

5. Long short-term memory self-adapting online random forests for evolving data stream regression

Cited by 4 articles. 订阅此论文施引文献订阅此论文施引文献，注册后可以免费订阅5篇论文的施引文献，订阅后可以查看论文全部施引文献

1. Impact, Compliance, and Countermeasures in Relation to Data Breaches in Publicly Traded U.S. Companies;Future Internet;2024-06-05

2. Machine Learning-Based Detection of API Security Attacks;Lecture Notes in Networks and Systems;2024

3. An electronic warfare approach for deploying a software-based Wi-Fi jammer;2022 5th International Conference on Contemporary Computing and Informatics (IC3I);2022-12-14

4. A Novel Approach for an Automated Advanced MITM Attack on IoT Networks;Advancements in Interdisciplinary Research;2022