Clankerusecase
MITRE ATT&CK detection coverage
← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1564.004

T1564.004NTFS File Attributes

T1564.004 — NTFS File Attributes is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 6 detection use cases covering it and 1 threat-intel article citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
6Use cases
1Articles
0Sub-techniques
1Tactic

Use cases covering this technique (6)

Windows Alternate DataStream - Base64 Content ESCU actions · alerting P Windows Alternate DataStream - Executable Content ESCU actions · alerting P Windows Alternate DataStream - Process Execution ESCU actions · alerting P Windows SymbolicLink-Testing-Tools Utility Execution ESCU actions · alerting P Windows Wermgr Alternate Data Stream in Temp Dir ESCU actions · hunting P [LLM] Gamaredon WinRAR CVE-2025-8088 ADS path-traversal dropping HTA/VBS into Startup folder Bespoke install · alerting DSΣPDDCS

Articles citing this technique (1)