Collect NTFS forensic information with osquery
Summary: Trail of Bits, in partnership with Crypsis, released an osquery extension that pulls additional NTFS filesystem metadata, including filename timestamps, file security descriptors, Alternate Data Streams, and deallocated directory index entries. Loading the extension adds three tables - ntfs_part_data, ntfs_file_data, and ntfs_indx_data - and it is loaded at osquery startup via a command line argument such as osqueryi.exe --extension path\to\ntfs_forensics.ext.exe.
What you should know: The extension targets the gaps attackers rely on after the fact: filename timestamps that survive a timestamp-altered file, deallocated index entries, and a rootkit hidden in the ADS of calc.exe - all queryable without leaving osquery or mapping a separate forensic report back to the fleet.
Read the original at Trail of Bits Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026