Dan :dumpster_fire: · @4n68r
90 followers · 52 posts · Server infosec.exchange

Re-sharing a 2019 article from @dfir that I just became aware of from @chadtilbury@twitter.com --> Running an executable in an ( on ) resulted in a file that is also in an ADS. binary-zone.com/2019/05/26/cre

This is interesting behavior. Has anyone observed this in the wild?

#alternatedatastream #ads #ntfs #prefetch #dfir #windows

Last updated 2 years ago

· @linkdrop
45 followers · 1816 posts · Server botsin.space