Files

Most users of Windows systems understand the basics of the Windows file systems; however, file systems include several less commonly used features that are often of value to attackers and defenders. Windows supports file links, shortcuts and junctions in the file system. Windows uses alternate data streams to configure the Mark of the Web, while attackers can use alternate data streams to store data. Because Windows carefully scrutinizes files with the Mark of the Web, attackers often want to avoid its placement. There are also edge cases where attackers can take advantage of behaviors that are not commonly encountered.