type: course-of-action
spec_version: 2.1
id: course-of-action--ac008435-af58-4f77-988a-c9b96c5920f5
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1096
external_id: T1096
source_name: Microsoft ADS Mar 2014
description: Marlin, J. (2013, March 24). Alternate Data Streams in NTFS. Retrieved March 21, 2018.
url: https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/
source_name: Symantec ADS May 2009
description: Pravs. (2009, May 25). What you need to know about alternate data streams in windows? Is your Data secure? Can you restore that?. Retrieved March 21, 2018.
url: https://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows-your-data-secure-can-you-restore
source_name: Beechey 2010
description: Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
url: http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599
source_name: Windows Commands JPCERT
description: Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
url: https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
source_name: NSA MS AppLocker
description: NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
url: https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm
source_name: Corio 2008
description: Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
url: http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx
source_name: TechNet Applocker vs SRP
description: Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.
url: https://technet.microsoft.com/en-us/library/ee791851.aspx
source_name: InsiderThreat NTFS EA Oct 2017
description: Sander, J. (2017, October 12). Attack Step 3: Persistence with NTFS Extended Attributes – File System Attacks. Retrieved March 21, 2018.
url: https://blog.stealthbits.com/attack-step-3-persistence-ntfs-extended-attributes-file-system-attacks
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:09.180Z
name: NTFS File Attributes Mitigation
description: It may be difficult or inadvisable to block access to EA and ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Symantec ADS May 2009) Efforts should be focused on preventing potentially malicious software from running. Identify and block potentially malicious software that may contain functionality to hide information in EA and ADSs by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Consider adjusting read and write permissions for NTFS EA, though this should be tested to ensure routine OS operations are not impeded. (Citation: InsiderThreat NTFS EA Oct 2017)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0