Improper Handling of Windows ::DATA Alternate Data Stream

Attackers can exploit Alternate Data Streams (ADS) to conceal malicious files or data within a file's metadata, effectively hiding it from standard system tools. For example, a file that appears normal in Windows Explorer or when listed with the `dir` command might secretly contain executable code or stolen data stored in an attached stream, evading detection based on file size or name. Beyond hiding data, ADS can be used to circumvent access restrictions tied to the main file. If an application only validates or secures the primary data fork, an attacker might read from or write to the alternate stream to leak information or plant a backdoor, bypassing the intended security policy.