Record · corpus.blog/posts/01a0bdc8-6f03-7055-ae5e-c136db0b2da5

Putting data in Alternate data streams and how to execute it

oddvar.moe · published 14 January 2018

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at oddvar.moe Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 20
Words captured: 565

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://twitter.com/enigma0x3

twitter.com

https://oddvar.moe/wp-content/uploads/2018/01/blogg-alternatedatastreams_1.jpg

oddvar.moe

https://oddvar.moe/wp-content/uploads/2018/01/blogg-alternatedatastreams_2.jpg

oddvar.moe

https://oddvar.moe/wp-content/uploads/2018/01/blogg-alternatedatastreams_3.jpg

oddvar.moe

https://oddvar.moe/wp-content/uploads/2018/01/blogg-alternatedatastreams_4.jpg

oddvar.moe

https://oddvar.moe/wp-content/uploads/2018/01/blogg-alternatedatastreams_5.jpg

oddvar.moe

https://oddvar.moe/wp-content/uploads/2018/01/blogg-alternatedatastreams_6.jpg

oddvar.moe

https://oddvar.moe/wp-content/uploads/2018/01/blogg-alternatedatastreams_7.jpg

oddvar.moe

https://www.nirsoft.net/utils/alternate_data_streams.html

nirsoft.net

https://twitter.com/ochsenmeier

twitter.com

Putting data in Alternate data streams and how to execute it – part 2 Read at the source ↗

oddvar.moe

https://enigma0x3.net/2015/03/05/using-alternate-data-streams-to-persist-on-a-compromised-machine/

enigma0x3.net

https://twitter.com/Oddvarmoe/status/951757732557852673

twitter.com

https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

gist.github.com

https://docs.microsoft.com/en-us/sysinternals/downloads/streams

docs.microsoft.com

https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

docs.microsoft.com

https://twitter.com/SwiftOnSecurity/status/952659933836791808

twitter.com

https://github.com/forgottentq/powershell/blob/master/find-steams.ps1

github.com

https://github.com/p0shkatz/Get-ADS

github.com

https://winitor.com/pdf/NtfsAlternateDataStreams.pdf

winitor.com