Question

You suspect an attacker has been securing sensitive files on a Windows host device for exfiltration. You also know that any interaction with the file system by the attacker will leave a trail of metadata that can be followed to determine if an attack or malware infection has occurred.

You decide to start by using the Window dir command to find any hidden files or folders the attacker may be storing on the Windows host.

Which of the following commands would you use to find these hidden files or folders?

answer

dir /AH


dir /R


dir /Q


dir /L

Answer 1

dir /AH

Explanation: the /A switch lists by attribute and H specifies hidden files/folders (you can also use dir /A:H). /R shows alternate data streams, /Q shows file owner, /L forces lowercase.