During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?

Question

Options

• ATemp directories aren't owned by any particular user, making it difficult to track the process owner
• BTemp directories are flagged as non-executable, meaning that no files stored within can be
• CTemp directories contain the system page file and the virtual memory file, meaning the attacker
• DTemp directories are world writable thus allowing attackers a place to drop, stage, and execute

• A
  3% (1)
• B
  3% (1)
• D
  93% (28)

Explanation

D is correct because C:\Windows\Temp (and temp directories generally) are configured with world-writable permissions, meaning any user - including low-privileged accounts - can write files there. Attackers exploit this to drop malicious payloads, stage tools, and execute them without needing elevated write access to protected system directories. This pattern is a classic "living off the land" technique seen in real-world malware and post-exploitation frameworks.

A is wrong - process ownership is fully trackable regardless of directory; tools like Task Manager, Sysmon, or EDR solutions log the user context of any spawned process.

B is wrong - temp directories carry no special "non-executable" flag in Windows; the filesystem doesn't restrict execution there by default (though hardened environments may use AppLocker/WDAC policies to block it).

C is wrong - the page file (pagefile.sys) lives in the root of the system drive (C:\), not in \Windows\Temp; this option conflates unrelated concepts.

Memory tip: Think "world writable = attacker's scratch pad." The key phrase to lock in is world writable - whenever you see a directory that any user can write to (Temp, /tmp, public shares), that's where attackers stage and execute. If you remember "writable = stageable = executable," you'll nail this category of question every time.

No community discussion yet for this question.