GCIH · Question #376
Why would an analyst run the following command on a host they suspect is compromised? C:\> c:\temp\lads\lads /S c:\Windows\System32
The correct answer is A. Find alternate data streams. The LADS tool enumerates NTFS Alternate Data Streams on a Windows file system, which attackers use to conceal malicious code or data inside legitimate files.
Question
Why would an analyst run the following command on a host they suspect is compromised? C:> c:\temp\lads\lads /S c:\Windows\System32
Options
- AFind alternate data streams
- BDetect a user-mode rootkit
- CStop hidden processes from running
- DRemove malicious DLLs from the system folder
How the community answered
(17 responses)- A88% (15)
- B6% (1)
- C6% (1)
Why each option
The LADS tool enumerates NTFS Alternate Data Streams on a Windows file system, which attackers use to conceal malicious code or data inside legitimate files.
LADS (List Alternate Data Streams) is specifically designed to scan NTFS volumes for files that have attached alternate data streams. Malware authors use ADS to hide payloads within benign files in directories like System32 because standard directory listings and most AV tools do not expose them. The /S flag recurses into subdirectories, allowing a full enumeration of the target path.
User-mode rootkit detection requires tools such as GMER or RootkitRevealer that compare kernel- and user-mode process and module listings; LADS only reads file system metadata and cannot detect hidden processes.
LADS is a read-only enumeration utility and has no capability to terminate, suspend, or otherwise interact with running processes.
LADS does not modify or delete files in any way; it only reports which files possess alternate data streams.
Concept tested: NTFS Alternate Data Stream forensic enumeration
Source: https://learn.microsoft.com/en-us/archive/blogs/askcore/alternate-data-streams-in-ntfs
Topics
Community Discussion
No community discussion yet for this question.