What technique uses NTFS streams to hide malicious files on the target system?

What technique uses NTFS streams to hide malicious files on the target system?

• A. Deleting Files
• B. Auditpol
• C. Covering Tracks on the OS
• D. Disabling Auditing

Answer: (C)

Using NTFS streams to hide files is about covering tracks on the OS by taking advantage of alternate data streams. NTFS allows a file to have additional named data streams beyond the main content, and these extra streams are often not shown in normal views. An attacker can attach a malicious payload to a file as a separate stream, making the hidden data invisible to casual inspection and even some scans. This lets malware reside on the system while appearing ordinary, reducing the chance it will be noticed. It’s distinct from merely deleting files, altering audit settings, or turning off auditing, all of which address visibility in different ways. To uncover such hidden data, you’d use tools that enumerate ADS (like Sysinternals Streams or PowerShell commands that list streams).

Using NTFS streams to hide files is about covering tracks on the OS by taking advantage of alternate data streams. NTFS allows a file to have additional named data streams beyond the main content, and these extra streams are often not shown in normal views. An attacker can attach a malicious payload to a file as a separate stream, making the hidden data invisible to casual inspection and even some scans. This lets malware reside on the system while appearing ordinary, reducing the chance it will be noticed. It’s distinct from merely deleting files, altering audit settings, or turning off auditing, all of which address visibility in different ways. To uncover such hidden data, you’d use tools that enumerate ADS (like Sysinternals Streams or PowerShell commands that list streams).