An analyst needs to forensically examine a Windows machine that was compromised by a threat actor. Intelligence reports state this specific threat actor is characterized by hiding malicious artifacts, especially with alternate data streams. Based on this intelligence, which of the following BEST explains alternate data streams?
A. A different way data can be streamlined if the user wants to use less memory on a Windows system for forking resources
B. A way to store data on an external drive attached to a Windows machine that is not readily accessible to users
C. A windows attribute that provides for forking resources and is potentially used to hide the presence of secret or malicious files inside the file records of a benign file
D. A Windows attribute that can be used by attackers to hide malicious files within system memory
Answer: D. A Windows attribute that can be used by attackers to hide malicious files within system memory
You might also like to view...
________ is a microblogging social networking site
A) Twitter B) Facebook C) Instagram D) LinkedIn
Which of the following queries/statements will result in an error message? Why? (Use tables created in the Chapter 4 Lab Activity)
1. SELECT LastName, FirstName FROM student; 2. SELECT DeptId, * FROM dept; 3. INSERT INTO dept VALUES (77, RESEARCH, NULL, NULL); 4. UPDATE employee SET DeptId = 88 WHERE EmployeeId = 111; 5. DELETE FROM dept WHERE DeptId = 10;