Bypass Record
Masquerading × Microsoft Windows Defender
A publicly-reported instance of Masquerading bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The loader uses CreateFileA to open a legitimate file's ADS (e.g., legit.txt:hidden.bin), reads the raw shellcode with ReadFile, allocates RWX memory via VirtualAlloc, and executes it via function pointer. Windows Defender scans the primary file stream but does not inspect the ADS content, allowing the malicious shellcode to remain undetected.
Detection & mitigation
Monitor for processes accessing NTFS Alternate Data Streams (ADS) via Sysmon Event ID 15 (FileCreateStreamHash) or Event ID 11 (FileCreate) with stream names, especially when followed by suspicious memory allocation (VirtualAlloc) and execution. Mitigation includes restricting ADS usage via AppLocker or Windows Defender Application Control (WDAC) and enabling real-time scanning of all file streams.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.