GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ503

Attacking Passwords

An attacker compromises a host and executes the following commands. What did the attacker do?

Question Image

  • A A tunnel was created
  • B A password was cracked
  • C A file was hidden
  • D A log file was edited
Explanation

NTFS named alternate data streams use the filename:streamname syntax. Redirecting the executable into SecEventLog.txt:mimikatz.exe stores it in an alternate stream associated with the log file, which is not normally visible through standard file viewing. Microsoft Learn: NTFS Streams

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!