Platform Internals — Index
Platform Internals — Index
BLUF. This shelf explains how platforms work under the hood. Applied assessment runbooks live in
4_Domain Playbooks; offensive tradecraft lives in1_RTO.
Shelves
| # | Folder | Start here |
|---|---|---|
| 3.2 | 3.2 Windows OS/ |
Windows internals — Resources |
| 3.3 | 3.3 Build Your Own OS/ |
Build Your Own OS |
| — | OS/ |
64-bit MAC — cross-platform VM/memory notes |
| — | DB/ |
Oracle DB |
Windows platform-internals path
| Track | Entry |
|---|---|
| Windows basics | 0. Resources |
| EDR / defense | EDR — blue team view |
| Code integrity | Windows Code Integrity Engine |
| Authentication | LSASS — local and domain |
Applied and offensive continuations
| Need | Destination |
|---|---|
| Windows assessment, Defender/SentinelOne, evidence, hunting, and lab baselines | Windows Domain Playbook |
| Linux discovery, logging, audit, and hardening | Linux Domain Playbook |
| Windows/AD attack and EDR-evasion detail | OW64 Windows Tradecraft |
| Linux offensive tradecraft | OW64 Linux |
Taxonomy history
- 2026-08-27: legacy
5. Linux thing/6. Windows OSaligned under shelf 3. - 2026-09-02:
3_Operating Systemsrenamed3_Platform Internals; applied runbooks moved to Domain Playbooks; attack-focused material moved to RTO.