Windows 11 Security Engineering — Map of Content
Windows 11 Security Engineering — Map of Content
Summary
A guided path from the Windows kernel down to files, folders, DLLs, and live processes — written for security engineers who need to investigate, harden, and reason about attacks without drowning in trivia. Work through the modules in order; use the lab workbook on 192.168.50.114 for hands-on checks.
| Lab host | 192.168.50.114 — Win11 build 26200, SSH tester808 / tester (MiniMac inventory) |
| Live baseline | Lab baseline (.114) — authoritative inventory, re-audit after patches |
| Prerequisite | Basic CLI comfort; no kernel driver writing required |
| Time shape | ~1 module per sitting; 10 modules + lab workbook + Defender deep dive |
| Existing depth | 00-dll-target-selection, 01-read-only-dll-inspection-amsi-part-1 |
Lab boundary
These modules teach inspection and understanding. Offensive bypass content lives elsewhere in the vault — start read-only on system binaries.
How to use this path
Each module uses the same shape:
| Section | What you get |
|---|---|
| 0. Purpose | Why a security engineer cares |
| 1. ELI5 | Mental model in plain language |
| 2. Deep breakdown | Names, diagrams, tables |
| Security engineer lens | What to hunt, log, and harden |
| Lab checkpoint | Commands to run on .114 |
| Record in notebook | What to write down before moving on |
flowchart TD M1[[11 Module 1
Kernel & rings]] M2[[12 Module 2
User mode & syscalls]] M3[[13 Module 3
DLLs & PE]] M4[[14 Module 4
Filesystem & folders]] M5[[15 Module 5
Processes & handles]] M6[[16 Module 6
Apps & services]] M7[[17 Module 7
Security map]] DEF[[19 Defender
architecture]] EVD[[21 Evidence
EVTX & artifacts]] LSASS[[22 LSASS
identity & auth]] LAB[[18 Lab workbook
.114]] BASE[[20 Lab baseline
.114]] M1 --> M2 --> M3 --> M4 --> M5 --> M6 --> M7 M7 --> DEF M7 --> EVD EVD --> LSASS M1 -.-> LAB M2 -.-> LAB M3 -.-> LAB M4 -.-> LAB M5 -.-> LAB M6 -.-> LAB M7 -.-> LAB BASE -.-> LAB
Three-tier maturity
| Tier | Modules | Outcome |
|---|---|---|
| 1 — Foundations | 1–7 + lab workbook | Draw kernel→process stack; run baseline commands |
| 2 — Platform security | Defender, baseline | Understand WdFilter, ASR, tamper/PUA; diff policy |
| 3 — Investigation | EVTX, LSASS | Sysmon installed ✓; ProcExp + Sysmon hunt exercise |
Reading order
| # | Module | You will understand… |
|---|---|---|
| 1 | Kernel and privilege rings | Ring 0 vs 3, ntoskrnl.exe, drivers, what user code cannot do |
| 2 | User mode and syscalls | kernel32 → ntdll → syscall → kernel; the trust boundary |
| 3 | DLLs, loaders, and PE | How modules load, imports/exports, why DLL choice matters |
| 4 | Filesystem, folders, and artifacts | System32, profiles, ProgramData, evidence locations |
| 5 | Processes, threads, and handles | PEB, tokens, parent/child, what ProcExp actually shows |
| 6 | Applications, services, and autoruns | Services vs tasks vs Run keys; persistence surface |
| 7 | Security engineer map | Tie kernel → DLL → process → defender/AMSI/integrity |
| 8 | Defender architecture & rulesets | MDAV stack, WdFilter PreOp/PostOp, ASR, tamper/PUA — baseline .114 |
| 9 | Evidence, EVTX & artifacts | 15 artifact layers, Event IDs, lab log gaps |
| 10 | LSASS, identity & authentication | LSA packages, Credential Guard, auth Event IDs |
| 11 | Sysmon first hunt workbook | Correlate Sysmon + 4688 + ProcExp/Procmon |
| 12 | c2_rust implant hunt correlation | Hunt telemetry + §9 beacon build/deploy pipeline |
| 13 | agentctl beacon drop research | Carrier/UDRL/stager load pipelines + drop matrix |
| 14 | Drop research round 2 | SEC_IMAGE, stomp, pulse, stager survival matrix |
| 15 | Defender safe drop paths | Live path probe — no unwatched folders; content/trigger tiers |
| AD | AD domain lab setup | DC01 on .115, join .114, Kerberos hunts |
| — | Lab baseline (.114) | Authoritative live inventory — cite when verifying claims |
| — | Lab tools inventory | Sysinternals, Sysmon, Procmon/ProcExp usage |
| — | Lab workbook (.114) | Copy-paste lab session with pass criteria |
DLL inspection track (parallel)
Already in this folder — use after Module 3:
| # | Guide | Role |
|---|---|---|
| 0 | DLL target selection | PE structure, kernel relationship, pick a DLL |
| 1 | Read-only DLL inspection Part 1 | Worked example on amsi.dll |
Vault cross-links (deeper dives)
| Topic | Note |
|---|---|
| PE format | Portable Executable Structure |
| Syscalls | Syscalls Flow |
| PEB / TEB | PEB / TEB |
| ntdll | NTDLL overview |
| Win32 vs Native API | Win32 vs Native API |
| Code integrity | Code Integrity Engine |
| EDR (blue) | EDR like a blue team |
Navigation
← Windows Playbook · Start → Module 1