Which command conceals a malicious executable inside a text file using NTFS Alternate Data Streams?

Enhance your skills for the CompTIA PenTest+ Exam with CertMaster. Utilize flashcards and multiple-choice questions with detailed explanations. Get fully prepared for your certification!

The correct choice for concealing a malicious executable inside a text file using NTFS Alternate Data Streams is achieved with the command that utilizes the "type" command. This command reads the data from the specified executable and redirects it into an Alternate Data Stream (ADS) of the text file.

In this context, the syntax is set up to create an ADS called "malware.exe" within the file "comptia.txt." Since this technique involves NTFS file systems, the data is not stored in the usual file attributes but in a hidden stream associated with the text file. As a result, the executable can exist without being easily detected, effectively camouflaged as a regular text file while still being executable if accessed through its ADS.

The other options do not correctly utilize the appropriate method for creating an ADS. The alternatives either use incorrect commands for redirection or incorrectly attempt to manipulate file locations. It’s crucial to understand both the concept of NTFS Alternate Data Streams and the precise mechanisms for storing data through these methods to recognize why this particular approach is used for concealing files.

Subscribe

Get the latest from Examzify

You can unsubscribe at any time. Read our privacy policy