Decent writeup from CS with that evasion method described - https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spider-ransomware/#:~:text=Hiding%20Persist

Decent writeup from CS with that evasion method described - https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spider-ransomware/#:~:text=Hiding%20Persistence%20in%20NTFS%20Alternate%20Data%20Stream%20(ADS) https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spid...