Which command is used to collect information about files opened by an intruder using remote login?

Which command is used to collect information about files opened by an intruder using remote login?

• A. net share
• B. net file
• C. tasklist
• D. netstat

Answer: (B)

The command used to collect information about files opened by an intruder using remote login is “net file.” This command is part of the networking utilities in Windows and is specifically designed to list open files on a file server. It provides information about files that are currently open across the network, allowing an administrator to see which users have files open and which shared resources they are accessing. This is particularly useful in a forensic context as it can reveal unauthorized access or data exfiltration by showing what files are being accessed by an intruder who has logged in remotely. Monitoring opened files is essential to understanding potential threats and taking appropriate actions. Other commands listed serve different purposes. For instance, "net share" displays shared resources on a computer; "tasklist" provides a list of currently running processes; and "netstat" shows active network connections and listening ports, but none of these directly indicate which files are opened remotely by users. Therefore, “net file” is the most appropriate choice for this purpose.

The command used to collect information about files opened by an intruder using remote login is “net file.” This command is part of the networking utilities in Windows and is specifically designed to list open files on a file server. It provides information about files that are currently open across the network, allowing an administrator to see which users have files open and which shared resources they are accessing.

This is particularly useful in a forensic context as it can reveal unauthorized access or data exfiltration by showing what files are being accessed by an intruder who has logged in remotely. Monitoring opened files is essential to understanding potential threats and taking appropriate actions.

Other commands listed serve different purposes. For instance, "net share" displays shared resources on a computer; "tasklist" provides a list of currently running processes; and "netstat" shows active network connections and listening ports, but none of these directly indicate which files are opened remotely by users. Therefore, “net file” is the most appropriate choice for this purpose.