Techniques
Sample rules
Windows Alternate Data Stream Created Over Local Share
- source: splunk
- technicques:
Description
The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. Legitimate local processes access files directly rather than through a local SMB share. This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32. If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately.
Detection logic
`wineventlog_security`
EventCode=5145
IpAddress="127.0.0.1"
ObjectType="File"
| regex RelativeTargetName="(?i)\:\w+$"
| fillnull
| rename IpAddress as dest_ip
| stats count min(_time) as firstTime
max(_time) as lastTime
by dest dest_ip
ShareName ShareLocalPath RelativeTargetName
AccessMask src_user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_alternate_data_stream_created_over_local_share_filter`