Loader Self-Deletion via ADS Rename + FileDispositionInfo Delete
This rule detects potential file obfuscation attempts where a file is renamed to include a colon followed by a 6 to 10 character suffix, characteristic of an NTFS Alternate Data Stream (ADS). It monitors for a specific pattern where a file is renamed to this format and followed by a file deletion or another rename of the same file within a 300-second window, which may indicate an adversary trying to hide content or bypass security controls.
Microsoft Sentinel (KQL)
