streams (ADS)

streams.exe -s <path>

Lists the Alternate Data Streams (ADS) of files in a directory, the NTFS mechanism attackers abuse to hide data.

Run it when you suspect a host is hiding data or executables in ADS: the recursive scan (-s) of a directory lists each file with its alternate streams — a legitimate file with an extra stream of suspicious size is the hiding pattern. ADS are the classic way to hide payloads (malware that executes from the stream via wmic or PowerShell) and to exfiltrate data without changing the visible file. In IR, scanning the affected user's directories and recently downloaded files is the step that finds the hidden payload.

Don't treat all ADS as malicious: Windows and many applications create legitimate streams (Zone.Identifier from downloaded files, SummaryInformation from Office) — Zone.Identifier appears on any download and is not an indicator by itself. The value is in streams with large sizes or non-standard names. And note: streams.exe only sees ADS on NTFS; on exFAT/FAT they don't exist. For execution from ADS, the trace is in process logs (wmic/PowerShell with the stream path), not in the stream itself.