Alternate Data Stream Attack Framework to Perform Stealth Attacks on Active Directory Hosts

Abstract

Microsoft’s file system, NTFS, is the most utilised file system by Windows OS versions XP, Vista, 7, and 10. These systems have a little-known file attribute feature known as alternate data streams (ADS) which allows each file in the NTFS file system to have multiple data streams. ADS cannot be removed from the NTFS operating systems. However, the presence of ADS is not inevitably an issue in the OS or file system. Valid instances can be found on systems if scanned and might be valid. Windows OS does not have any in-built tools or applications to determine and remove the presence of existing ADS. This research presents ADSA or alternate data stream attack framework to exploit the alternate data streams and perform cyberattacks on Microsoft operating systems. This research discusses the process of creating and searching alternate data streams with a standard file and an executable binary. The authors executed ADS-hidden executable binary in the ADS. The authors present methods to detect and perform a clean-up by deleting the alternate data stream.

RansomCillin: Leveraging NTFS Spare Space to Recover from Ransomware Attacks

“…The ethical and practical considerations surrounding ransom payment are examined, including the potential risks and implications of negotiating with attackers [9]. Backup and contingency planning are highlighted as essential components of a comprehensive ransomware mitigation strategy [39]. The role of emergency response teams and thirdparty cybersecurity firms in managing the aftermath of an attack is also explored, providing insights into the collaborative efforts required to mitigate the impact of ransomware [15].…”

“…In particular, RansomCillin's proficiency in rapidly reverting files to their pre-attack state offers significant advantages [15], [16]. The software effectively minimizes downtime, a crucial factor for businesses where prolonged inaccessibility to data can lead to substantial operational disruptions and financial setbacks [39], [8]. The ability of RansomCillin to operate with a marginal impact on overall system performance ensures that users can continue their routine activities without experiencing significant slowdowns or disruptions, an essential aspect for maintaining productivity in a high-paced digital workspace.…”

RansomCillin: Leveraging NTFS Spare Space to Recover from Ransomware Attacks

“…The ethical and practical considerations surrounding ransom payment are examined, including the potential risks and implications of negotiating with attackers [9]. Backup and contingency planning are highlighted as essential components of a comprehensive ransomware mitigation strategy [38]. The role of emergency response teams and thirdparty cybersecurity firms in managing the aftermath of an attack is also explored, providing insights into the collaborative efforts required to mitigate the impact of ransomware [15].…”

“…In particular, RansomCillin's proficiency in rapidly reverting files to their pre-attack state offers significant advantages [15], [16]. The software effectively minimizes downtime, a crucial factor for businesses where prolonged inaccessibility to data can lead to substantial operational disruptions and financial setbacks [38], [8]. The ability of RansomCillin to operate with a marginal impact on overall system performance ensures that users can continue their routine activities without experiencing significant slowdowns or disruptions, an essential aspect for maintaining productivity in a high-paced digital workspace.…”