NTFS Alternate Data Streams (ADS) are a Windows filesystem feature that lets one file carry extra named data streams beyond its main content. The primary file still looks normal, but hidden streams can store metadata or additional bytes that many tools ignore unless they explicitly inspect them. ADS are legitimate and useful, but they matter in security because they can hide payloads, configuration data, or evidence of tampering from simple directory listings and casual scans.
In attacks, ADS may be used to disguise how a file was written, to stage content for later execution, or to complicate forensic review after a crafted archive extracts files. Defenders look for unusual stream names, unexpected stream sizes, and files whose on-disk behavior does not match their visible contents. Stream-aware antivirus, EDR, and manual inspection with Windows utilities help reveal this hiding place.