Enter your search text in the box above

Select a result to preview

Module 4 — Filesystem, Folders, and Artifacts

#windows #windows-11 #filesystem #module

Module 4 — Filesystem, Folders, and Artifacts

Summary

Windows is a folder contract. Security engineers memorize a small set of paths — OS binaries, profiles, ProgramData, logs — and hunt for writes outside the contract.

Path: Module 3 · Next: Module 5

0. Purpose

Incidents arrive as paths: C:\Users\...\Downloads\, ProgramData\Microsoft\Windows Defender\, System32\config\. You need a mental map of what belongs where and who can write there.

1. ELI5

Windows is a library building:

Malware often hides in user-writable desks or misplaced copies of system files.

2. Deep breakdown

Top-level map (security engineer view)

Path What lives here Write access (typical) Investigate for
C:\Windows\System32\ Inbox 64-bit OS binaries Admin / TrustedInstaller Masquerading, unsigned drops
C:\Windows\SysWOW64\ 32-bit compatibility binaries Admin Same, WOW64 confusion
C:\Windows\System32\drivers\ Kernel drivers .sys Admin + signing policy Rogue drivers
C:\Windows\Temp\ Short-lived system temp Many principals Staging, scripts
C:\Program Files\ 64-bit applications Admin install Sideload, weak perms
C:\Program Files (x86)\ 32-bit apps Admin install Same
C:\ProgramData\ Machine-wide app state Varies by subfolder Defender platform, updates
C:\Users\<user>\AppData\ Per-user app data That user Roaming malware, tokens
C:\Users\<user>\Downloads\ User downloads User Initial access payloads

User profile layout

C:\Users\<user>\
├── Desktop\
├── Documents\
├── Downloads\          ← common ingress
├── AppData\
│   ├── Local\          ← caches, large app data
│   ├── LocalLow\
│   └── Roaming\        ← follows user in domain
└── NTUSER.DAT          ← registry hive (loaded when logged on)

Defender / security artifacts (Win11)

Path Content
C:\Program Files\Windows Defender\ Inbox Defender binaries (MpClient.dll, etc.)
C:\ProgramData\Microsoft\Windows Defender\ Platform versions, signatures, scan history
C:\Windows\System32\winevt\Logs\ Event logs (.evtx)
C:\Windows\System32\amsi.dll AMSI user-mode interface
MpClient.dll is often not in System32 — see verified lab inventory.

Junctions and confusion (Win11)

Name Reality on x64
System32 64-bit binaries
SysWOW64 32-bit binaries
Program Files 64-bit
Program Files (x86) 32-bit

Attackers abuse path confusion and case/alternate streams — always resolve full path + signature.

EVTX and log storage

Path Content
C:\Windows\System32\winevt\Logs\ All .evtx channel files
Security.evtx Auth, privilege, process audit (if enabled)
Microsoft-Windows-Windows Defender%4Operational.evtx Defender detections, ASR
Microsoft-Windows-PowerShell%4Operational.evtx PowerShell engine events

Deep dive: Module 9 — Evidence & EVTX.

Lab .114 log gaps (baseline)

Log Status Priority fix
Defender/Operational 313 records — enabled Use for hunts now
Security 21k+ records Enable advanced audit policies
Sysmon/Operational Installed Use for hunts — 23-lab-tools-inventory
TaskScheduler/Operational Disabled Enable for persistence hunts
PowerShell 4104 Policy not set Enable script block logging

NTFS timeline artifacts (investigator)

Artifact Path / command Win11 note
USN Journal fsutil usn queryjournal C: File create/rename/delete
Prefetch C:\Windows\Prefetch\ Often disabled — verify before relying
AmCache C:\Windows\AppCompat\Programs\Amcache.hve Execution/install metadata

Security engineer lens

Control Folder tie-in
WDAC / App Control What can execute from which paths
Controlled folder access Blocks writes to protected folders
Permissions / ACLs icacls, writable Program Files = red flag
Prefetch / Amcache / Shimcache Execution evidence (separate artifacts)

Baseline habit: for any suspicious file, record full path, signer, hash, creating process — not filename alone.

Lab checkpoint — 192.168.50.114

# Your profile roots
$env:USERPROFILE
Get-ChildItem $env:USERPROFILE | Select-Object Name, Mode

# Key OS paths — existence + size snapshot
@(
  "$env:windir\System32",
  "$env:windir\System32\drivers",
  "$env:ProgramData\Microsoft\Windows Defender",
  "$env:ProgramFiles\Windows Defender"
) | ForEach-Object {
  [PSCustomObject]@{
    Path = $_
    Exists = Test-Path $_
    Items = if (Test-Path $_) { (Get-ChildItem $_ -ErrorAction SilentlyContinue | Measure-Object).Count } else { $null }
  }
} | Format-Table -AutoSize

# Who can write Downloads?
icacls "$env:USERPROFILE\Downloads" | Select-Object -First 5

Record in notebook

← Module 3 · Module 5 →