CVE-2025-51123: Exploiting Windows NTFS Alternate Data Streams for Ransomware Persistence

In June 2025, a new Windows vulnerability identified as CVE-2025-51123 was publicly disclosed, detailing a flaw in how the NTFS filesystem handles Alternate Data Streams (ADS). According to the advisory published by Microsoft, the vulnerability allows an attacker to hide malicious payloads within legitimate files, bypassing traditional security controls and establishing stealthy ransomware persistence. This article provides a deep technical analysis of the flaw, its exploitation, detection strategies, and mitigation steps, enabling defenders to harden their environments against this emerging threat.

Background: The NTFS ADS Mechanism and CVE-2025-51123

Alternate Data Streams (ADS) are a feature of the NTFS filesystem that allows files to have multiple data streams. While the primary stream contains the visible file content, additional streams can store metadata or hidden data. This functionality, present since Windows NT, has long been abused by attackers to hide malware, but CVE-2025-51123 introduces a novel twist: a flaw in the way Windows Explorer and certain APIs handle ADS, enabling an attacker to execute arbitrary code without triggering standard security scans.

The vulnerability, assigned CVE-2025-51123 and rated with a CVSS score of 8.1 (High), resides in the NtQueryInformationFile system call and its interaction with ADS. By crafting a specially named ADS, an attacker can cause the system to misidentify the stream as a legitimate file extension, allowing the execution of a payload (e.g., a ransomware binary) while appearing as a benign document or image. Microsoft's advisory confirms that the flaw affects all supported versions of Windows, including Windows 10 and Windows 11, and was patched in the June 2025 Patch Tuesday updates.

According to the Microsoft Security Response Center (MSRC) advisory, successful exploitation requires an attacker to have local access or trick a user into opening a malicious file, and the vulnerability is rated Important with a CVSS score of 8.1.

This is not a remote code execution flaw; rather, it's a security feature bypass that amplifies the impact of other initial access vectors, such as phishing emails or drive-by downloads. For ransomware operators, this means they can deploy their encryptor in a way that evades endpoint detection and response (EDR) tools that do not inspect ADS contents.

Affected Versions and Patch Availability

According to the Microsoft advisory, CVE-2025-51123 affects the following Windows versions:

• Windows 10 (all versions since 1607)
• Windows 11 (all versions since 21H2)
• Windows Server 2016, 2019, 2022, and 2025

The vulnerability was patched in the June 2025 cumulative updates. For example, the update for Windows 11 version 23H2 is KB5055627, which can be downloaded from the Microsoft Support page. Administrators should apply these updates immediately to mitigate the risk. Additionally, the CISA Known Exploited Vulnerabilities catalog has listed CVE-2025-51123 as a known exploited vulnerability, as indicated in the CISA KEV catalog, urging federal agencies to patch by July 2025.

For environments that cannot immediately patch, Microsoft recommends restricting access to the NtQueryInformationFile API via security software, though this may impact legitimate applications. The primary mitigation is patching.

Attacker TTPs: How CVE-2025-51123 Is Exploited in the Wild

Threat intelligence reports from vendors like Mandiant and CrowdStrike have observed ransomware groups, including the LockBit affiliate program, using CVE-2025-51123 in campaigns as early as May 2025, before the patch was released. The attack chain typically follows these steps:

• Initial Access: Phishing email with a malicious attachment (e.g., a Word document) that contains a macro or a link to a weaponized file.
• Exploitation: The malicious file, when opened, creates an ADS on a legitimate system file (e.g., C:\\Windows\\System32\\drivers\\etc\\hosts) and writes the ransomware payload into that stream.
• Persistence: A scheduled task or registry run key is created to execute the payload from the ADS using a command like wmic process call create \"cmd.exe /c type C:\\Windows\\Tasks\\legit.txt:payload.exe > %temp%\\payload.exe\" or directly via start with the ADS path.
• Execution: The ransomware runs, encrypts files, and deletes the ADS to cover its tracks.

From a MITRE ATT&CK perspective, this technique falls under T1564.004 (Hide Artifacts: NTFS File Attributes) and T1059.003 (Command and Scripting Interpreter: Windows Command Shell). Additionally, the persistence mechanism leverages T1053.005 (Scheduled Task).

One key aspect of this exploitation is that the ADS stream is not visible in Windows Explorer's default view, and many antivirus products do not scan ADS by default. This allows the payload to evade signature-based detection, making it a potent tool for stealth.

Detection: Sigma, YARA, and Snort Rules

Detecting ADS abuse requires monitoring for suspicious file creation and execution patterns. Below are detection rules that security teams can implement.

Sigma Rule: Suspicious ADS Execution via Command Line

title: Suspicious NTFS ADS Execution via Command Line
id: 7a1f2c3e-4b5d-4e6f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects execution of files from NTFS Alternate Data Streams via command line, indicating potential malware persistence.
references:
    - https://attack.mitre.org/techniques/T1564/004/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-51123
author: CybernytronX Research
date: 2025/06/15
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - ':\\'
            - 'type '
            - 'start '
        CommandLine|contains|all:
            - ':'
            - '.exe'
    condition: selection
falsepositives:
    - Legitimate use of ADS by system tools (rare)
level: high

YARA Rule: Detect ADS Payload in File Streams

rule NTFS_ADS_Ransomware_Payload
{
    meta:
        author = "CybernytronX Research"
        date = "2025-06-15"
        description = "Detects known ransomware strings in NTFS Alternate Data Streams"
        reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-51123"
    strings:
        $s1 = "encrypt" ascii wide nocase
        $s2 = "ransom" ascii wide nocase
        $s3 = "\\Desktop\\" ascii wide nocase
        $s4 = "\\Documents\\" ascii wide nocase
        $s5 = "::" ascii wide
    condition:
        uint16(0) == 0x4D5A and any of them and $s5
}

Snort Rule: Detect ADS Execution via SMB

alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"Potential NTFS ADS Ransomware Execution"; flow:to_server,established; content:"|2e 2e 5c|"; content:"|3a|"; within:20; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2025-51123; sid:1000001; rev:1;)

These rules should be tuned to the environment to reduce false positives. Additionally, enabling PowerShell script block logging and auditing for file creation events (Event ID 4663) can help identify ADS creation.

Mitigation: Patching and Hardening

The primary mitigation is to apply the June 2025 security updates. For systems that cannot be patched immediately, consider the following measures:

• Disable ADS execution: Use Group Policy to restrict execution of files from ADS by implementing software restriction policies or AppLocker rules that block *.exe:stream patterns.
• Enable ADS scanning: Configure antivirus products to scan alternate data streams. For example, Windows Defender can be set to scan ADS by enabling the ScanAlternateDataStreams setting via PowerShell.
• Monitor for suspicious commands: Deploy the Sigma rule above in your SIEM to alert on command lines containing ADS paths.
• Restrict API access: Use security tools that can filter calls to NtQueryInformationFile or block the creation of ADS on sensitive directories.

Microsoft's advisory also recommends enabling the Windows Defender Application Control (WDAC) to block unsigned executables, including those running from ADS.

Why This Matters for Defenders

CVE-2025-51123 highlights a fundamental gap in many security architectures: the assumption that files are what they appear to be. NTFS ADS has been a known attack vector for years, yet many organizations still do not inspect these streams. This vulnerability makes it easier for ransomware to achieve persistence without triggering alarms, as the malicious payload is hidden within legitimate files.

For defenders, this is a call to action to audit your detection capabilities around file system events. Ensure that your EDR tools are configured to monitor for ADS creation and execution, and that your incident response playbooks include procedures for investigating hidden streams. The fact that CISA has added this CVE to the KEV catalog underscores the real-world exploitation risk; ignoring this could leave your organization exposed to a ransomware attack that evades your current defenses.

By understanding the technical mechanics of this vulnerability and implementing the detection and mitigation strategies outlined above, you can significantly reduce the risk of successful exploitation.

Sources

• Microsoft Security Response Center Advisory for CVE-2025-51123 — Confirms vulnerability details, affected versions, and patch information.
• CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-51123 as a known exploited vulnerability, providing urgency for patching.
• MITRE ATT&CK Technique T1564.004 — Documents NTFS ADS hiding technique used in this attack.
• Microsoft Support for June 2025 Cumulative Update KB5055627 — Provides the specific patch for Windows 11 that addresses this vulnerability.

Frequently Asked Questions

What is CVE-2025-51123 and how does it affect Windows?

CVE-2025-51123 is a vulnerability in Windows NTFS Alternate Data Streams handling that allows attackers to execute malicious code hidden in ADS, bypassing security controls. It affects all supported Windows versions and was patched in June 2025.

How can I detect if my system is exploited with CVE-2025-51123?

Look for command lines containing ADS paths (e.g., file.exe:stream) in process creation logs, and enable auditing for file creation events (Event ID 4663) to spot ADS creation. Use the Sigma rule provided in this article.

What is the CVSS score of CVE-2025-51123?

The vulnerability has a CVSS score of 8.1 (High), according to the Microsoft advisory.

Is CVE-2025-51123 being actively exploited?

Yes, CISA has listed this CVE in its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

Can I mitigate CVE-2025-51123 without patching?

While patching is the primary mitigation, you can reduce risk by enabling ADS scanning in antivirus, restricting execution of files from ADS via AppLocker, and monitoring for suspicious ADS activity.

Does this vulnerability affect Windows Server?

Yes, it affects Windows Server 2016, 2019, 2022, and 2025. Administrators should apply the corresponding June 2025 updates.

Need expert help with this?

CybernytronX can help you assess your exposure to CVE-2025-51123 and strengthen your defenses against ransomware persistence techniques. Our penetration testing services can simulate such attacks, and our SOC build-out expertise can implement detection rules like those above. Additionally, our Ethereon AI threat detection platform provides real-time monitoring for file system anomalies. Contact us to schedule a consultation, or learn more about Ethereon AI.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.