Write to ADS, discover, or download files with Findstr.exe
findstr /V /L W3AllLov3LolBas c:\ADS\file.exe > c:\ADS\file.txt:file.exe
Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.
Add a file to an alternate data stream to hide from defensive counter measures
C:\Windows\System32\findstr.exe, C:\Windows\SysWOW64\findstr.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml
Oddvar Moe (@oddvarmoe)