This endpoint analytic detects the creation of NTFS alternate data streams (ADS) that are accessed over a local administrative share using the loopback address 127.0.0.1. It relies on Windows Security Event Logs (EventCode 5145) to identify file-access events over a local share. The rule looks for ADS usage patterns where an alternate data stream is created on a target file via a local/admin share path, which is unusual for legitimate software and can indicate covert data placement. The detection captures the destination host (dest), destination IP (dest_ip, typically 127.0.0.1), the local share involved (ShareName, ShareLocalPath), the RelativeTargetName (which identifies the ADS), and the source user (src_user). It also records time boundaries (firstTime/lastTime) to establish an activity window. This technique aligns with a known threat pattern where attackers abuse ADS to hide payloads on system-owned files (e.g., within C:\Windows\System32) as part of local privilege escalation. The rule references the ShieldBreak exploit behavior by swapping symbolic links to redirect defender-driven writes into an ADS. MITRE coverage includes T1564.004 (Hide Artifacts: Alternate Data Streams) and T1021.002 (SMB/Windows Admin Shares). The analytic is designed to raise a high-severity alert when an unusual ADS operation occurs over a loopback administrative share, signaling potential in-progress compromise.