Splunk unknown stable spl

Windows Alternate Data Stream Created Over Local Share

The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. Legitimate local processes access files directly rather than through a local SMB share. This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32. If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately.

View Source

Detection Logic

`wineventlog_security`
EventCode=5145
IpAddress="127.0.0.1"
ObjectType="File"
| regex RelativeTargetName="(?i)\:\w+$"
| fillnull
| rename IpAddress as dest_ip
| stats count min(_time) as firstTime
              max(_time) as lastTime
  by dest dest_ip
     ShareName ShareLocalPath RelativeTargetName
     AccessMask src_user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_alternate_data_stream_created_over_local_share_filter`

False Positives

⚠ Backup, replication, or file-sync software may occasionally write alternate data streams over administrative shares. Loopback (127.0.0.1) access to a local share is rare for legitimate software, tune by ShareName or src_user as needed for your environment.

Field Validations

Loading…

Comments (0)

Loading comments...