value:  LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions. ;; PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS). ;; If the victim is using PowerShell 3.0 or later POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in %PROGRAMDATA%\Windows\. ;; The Regin malware platform uses Extended Attributes to store encrypted executables. ;; Valak has the ability save and execute files as alternate data streams (ADS). ;; Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.
name: Hide Artifacts: Ntfs File Attributes