Windows Playbook — Index

#windows #domain-playbook #index

Windows Playbook — Index

Summary

Three tracks: Win11 security engineering, defensive field assessment, and read-only DLL inspection. Start the path that matches your goal.

Track A — Windows 11 security engineering (start here)

#	Guide	What you learn
MOC	Win11 Security Engineering MOC	Full reading path + lab host `.114`
1	Module 1 — Kernel and rings	Ring 0/3, `ntoskrnl`, drivers
2	Module 2 — User mode and syscalls	`kernel32` → `ntdll` → syscall
3	Module 3 — DLLs and PE	Loaders, imports/exports
4	Module 4 — Filesystem and folders	System32, profiles, Defender paths
5	Module 5 — Processes and handles	Tokens, parents, modules
6	Module 6 — Apps, services, autoruns	Persistence surface
7	Module 7 — Security engineer map	Full-stack wiring diagram
8	Defender architecture & rulesets	WdFilter, ASR, tamper/PUA — live baseline from `.114`
9	Module 9 — Evidence & EVTX	Event logs, artifacts, Sysmon gap analysis
10	Module 10 — LSASS & identity	Auth broker, Credential Guard, 4624/4648
11	Module 11 — Sysmon first hunt	End-to-end hunt lab with live scenario
AD	AD domain lab setup	Windows Server DC + domain join plan
Ref	Lab baseline (.114)	Authoritative inventory — re-audit after changes
Tools	Lab tools inventory	Sysinternals, Sysmon, WinDbg — install & usage
Lab	Lab workbook (.114)	Hands-on session on Win11 VM

Track B — Read-only DLL inspection

#	Guide	What you learn
0	Choosing a DLL for read-only inspection	PE structure, kernel relationship, target rubric
1	Read-only DLL inspection — Part 1	Worked example on `amsi.dll`

Track C — Defensive field assessment

#	Guide	What you learn
30	Windows internal device scan	Host, interface, neighbor, route, service, and reachability inventory
31	Defender + SentinelOne field manual	Product architecture, attack-chain validation, telemetry, cleanup, and interpretation

Topic	Note
PE file format	Portable Executable Structure
Lab host inventory	MiniMac — LAN lab hosts
Windows/AD and EDR attack paths	OW64 Windows Tradecraft
AMSI attack paths	Attack AMSI
API hooking	API Hooking

← Domain Playbooks Index