Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI

SigmaHQ Detections@sigmaHQ

•updated Sep 1, 2026•0•0•2

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"