T1564.004sub-technique of T1564 Hide Artifacts

NTFS File Attributes

Windowsnothing on this site yetT1564.004 on attack.mitre.org

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for NTFS File Attribute Abuse (ADS/EAs)

Suspicious use of NTFS file attributes such as Alternate Data Streams (ADS) or Extended Attributes (EA) to hide data. Defender perspective: anomalous file creations or modifications containing colon syntax (file.ext:ads), API calls like ZwSetEaFile/ZwQueryEaFile, or PowerShell/Windows utilities interacting with...

what reduces it

M1022 Restrict File and Directory Permissions. Consider adjusting read and write permissions for NTFS EA, though this should be tested to ensure routine OS operations are not impeded.

the rest of T1564

T1564.001 Hidden Files and Directories · not covered yet
T1564.002 Hidden Users · not covered yet
T1564.003 Hidden Window · not covered yet
T1564.005 Hidden File System · not covered yet
T1564.006 Run Virtual Instance · not covered yet
T1564.007 VBA Stomping · not covered yet
T1564.008 Email Hiding Rules · 2 on this site
T1564.009 Resource Forking · not covered yet
T1564.010 Process Argument Spoofing · not covered yet
T1564.011 Ignore Process Interrupts · not covered yet
T1564.012 File/Path Exclusions · not covered yet
T1564.013 Bind Mounts · not covered yet
T1564.014 Extended Attributes · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.