Platform Internals — Index

BLUF. This shelf explains how platforms work under the hood. Applied assessment runbooks live in 4_Domain Playbooks; offensive tradecraft lives in 1_RTO.

Shelves

#	Folder	Start here
3.2	`3.2 Windows OS/`	Windows internals — Resources
3.3	`3.3 Build Your Own OS/`	Build Your Own OS
—	`OS/`	64-bit MAC — cross-platform VM/memory notes
—	`DB/`	Oracle DB

Content status (2026-09-24): The Windows authentication and memory-layout
notes have been normalized around current platform boundaries. DB/Oracle DB/OracleDB remains a legacy offensive cheatsheet and is retained here for
compatibility; its long-term home should be 1_RTO.

Windows platform-internals path

Track	Entry
Windows basics	0. Resources
EDR / defense	EDR — blue team view
Code integrity	Windows Code Integrity Engine
Authentication	LSASS — local and domain

Applied and offensive continuations

Need	Destination
Windows assessment, Defender/SentinelOne, evidence, hunting, and lab baselines	Windows Domain Playbook
Linux discovery, logging, audit, and hardening	Linux Domain Playbook
Windows/AD attack and EDR-evasion detail	OW64 Windows Tradecraft
Linux offensive tradecraft	OW64 Linux

Taxonomy history

2026-08-27: legacy 5. Linux thing / 6. Windows OS aligned under shelf 3.
2026-09-02: 3_Operating Systems renamed 3_Platform Internals; applied runbooks moved to Domain Playbooks; attack-focused material moved to RTO.