Windows Internals for Defenders

Defenders who understand how Windows works investigate faster and write better detections. This roadmap covers the Windows internals that matter most for security. You need a Windows lab VM.

• Have a Windows 10/11 or Server lab VM
• Install Sysinternals tools
• Plan your study time

• CyberA4U Academy — courses

Windows separates user mode and kernel mode, uses services and drivers, and enforces security through tokens and access control lists. These concepts underpin every investigation.

• Explain user mode vs kernel mode
• Understand tokens, SIDs and ACLs
• Know the role of key system processes

الأدوات والتقنيات: Windows

• Microsoft — Access control

Processes, threads and their parent/child relationships reveal what's running and how it started — central to spotting malicious activity.

• Understand process creation and parent/child relationships
• Recognize normal system process trees
• Spot suspicious processes

الأدوات والتقنيات: Windows

• Microsoft — Processes and threads

Services and scheduled tasks run programs automatically — and are common persistence methods for attackers.

• Enumerate services and scheduled tasks
• Recognize suspicious configurations
• Monitor for new ones

الأدوات والتقنيات: Windows

• Microsoft — Services
• Microsoft — Task Scheduler

The registry stores configuration and many artifacts of user and program activity, including autostart locations.

• Navigate hives and keys
• Know key autostart locations
• Use Autoruns to review persistence

الأدوات والتقنيات: Windows

• Microsoft — Registry

Windows Event Logs record logons, process creation, service installs and policy changes — the core evidence for detection.

• Know key Security event IDs
• Configure advanced audit policy
• Collect logs centrally

الأدوات والتقنيات: Windows

• Microsoft — Appendix L: Events to monitor

Sysmon adds detailed telemetry — process creation with hashes, network connections, image loads — that native logs lack.

• Install Sysmon with a good configuration
• Understand key event types
• Reduce noise with filtering

الأدوات والتقنيات: Windows

• Microsoft Sysinternals — Sysmon

Windows authentication uses NTLM and Kerberos through authentication packages in LSASS. Understanding them helps detect credential theft.

• Explain NTLM and Kerberos at a high level
• Understand why LSASS is a target
• Know protections such as Credential Guard

الأدوات والتقنيات: Windows

• Microsoft — Authentication packages

Attackers persist through run keys, services, tasks, WMI and more. Knowing these locations speeds up investigations and cleanup.

• List common persistence locations
• Map them to ATT&CK
• Check them systematically

الأدوات والتقنيات: Windows

• MITRE ATT&CK — Persistence (TA0003)

PowerShell is heavily used by both admins and attackers. Script block and module logging reveal what scripts actually did.

• Enable script block and module logging
• Read event 4104
• Recognize suspicious script patterns

الأدوات والتقنيات: Windows

• Microsoft — about_Logging_Windows (PowerShell logging)

WMI can run commands and create persistence. Defenders watch for suspicious WMI activity and event subscriptions.

• Understand WMI's legitimate uses
• Recognize signs of WMI abuse
• Log WMI activity

الأدوات والتقنيات: Windows

• MITRE ATT&CK — Windows Management Instrumentation (T1047)

EDR tools see a lot but not everything. Knowing what telemetry is missing helps you add logs and avoid false confidence.

• Know what your EDR records
• Identify gaps (e.g. some script engines, kernel activity)
• Complement EDR with native logs

الأدوات والتقنيات: Windows

• MITRE ATT&CK — Data sources

A repeatable workflow — triage the alert, examine the process tree, check persistence, review logons and network activity — keeps investigations thorough.

• Follow a consistent investigation workflow
• Collect key artifacts quickly
• Document findings

الأدوات والتقنيات: Windows

• NIST SP 800-86 — Integrating Forensic Techniques into Incident Response

Threat hunting starts from a hypothesis — for example, "an attacker added a new service" — and searches telemetry to prove or disprove it.

• Write testable hunting hypotheses
• Choose data to test them
• Turn findings into detections

الأدوات والتقنيات: Windows

• MITRE ATT&CK — Persistence (TA0003)

Use a public dataset or your own safe simulation to reconstruct an intrusion from Windows logs and artifacts.

• Correlate process, logon and persistence evidence
• Build a timeline
• Write findings and detections

الأدوات والتقنيات: Windows

• Red Canary — Atomic Red Team

Check that you can investigate suspicious Windows activity using processes, logs, registry and persistence evidence.

• Collect and read key telemetry
• Find persistence
• Reconstruct a timeline

• CyberA4U CTF Arena — practice challenges

You now understand Windows internals as a defender. Continue with Detection Engineering, Digital Forensics or Active Directory Attacks (to see the attacker's side).

• Keep your lab and Sysmon config
• Choose your next roadmap
• Share an investigation write-up

• CyberA4U CTF Arena — practice challenges