~/giac-glir · study ▊
practice sheet · all objectives switch to smart practice →
GIAC Linux Incident Responder
0/4 checked
During a Linux intrusion investigation, an analyst suspects a malicious binary's timestamps were altered. According to the SANS whitepaper on timestomping across FAT, Ext3, and Ext4, what determines the specific methods an adversary can use to timestomp files?
Explanation
The whitepaper states adversaries adapt their timestomping approaches based on available system access and permissions [1].
sources
✓ Verified source
Sans ↗
focusing on how adversaries adapt their approaches based on available system access and permissions
An analyst examining an NTFS volume finds that a suspect executable's $STANDARD_INFORMATION timestamps do not match its $FILE_NAME timestamps. Why does comparing these two attribute sets help detect timestamp manipulation?
Explanation
Carrier's book, as quoted in the blog, notes Windows does not typically update the $FILE_NAME temporal values like it does $STANDARD_INFORMATION, and they frequently correspond to when the file was created, moved, or renamed [1]. This mismatch is what flagged the incident as manipulation [2].
Locked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to review