Module 7 — Security Engineer Map

Path: Module 6 · Lab: Lab workbook

0. Purpose

Modules 1–6 gave you parts. This module is the wiring diagram — how an analyst or defender moves from symptom → layer → artifact.

1. ELI5

Think of Windows 11 security as layers of referees:

1. Kernel — ultimate authority
2. Drivers / filters — watch files and network in the basement
3. Security services — LSASS, Defender (MsMpEng), code integrity
4. User hooks — AMSI for scripts, ETW for telemetry
5. Your apps — where users and attackers actually click

An alert tells you which referee blew the whistle — you walk down to see the play.

2. Deep breakdown — full stack

flowchart TB
  subgraph user [User mode]
    APP[Apps & scripts]
    AMSI[amsi.dll]
    DLL[Other DLLs]
    PROC[Processes / services]
  end

  subgraph defend [Defensive components]
    DEF[Defender MsMpEng]
    CI[Code Integrity / WDAC]
    EVT[ETW / Sysmon]
  end

  subgraph kernel [Kernel mode]
    KERN[ntoskrnl.exe]
    FLT[Minifilters / WFP]
  end

  APP --> AMSI
  APP --> DLL
  AMSI --> DEF
  PROC --> DLL
  DLL -->|syscall| KERN
  DEF --> KERN
  CI --> KERN
  FLT --> KERN
  EVT -.->|telemetry| PROC

Layer → artifact cheat sheet

Investigation flow (repeatable)

1. Alert or hypothesis (e.g. suspicious PowerShell)
2. Process: PID, parent, user, path, cmdline, integrity
3. Modules: any DLL from unusual path? amsi.dll loaded?
4. Files: dropped binaries under Users/Temp?
5. Persistence: new service/task/run key?
6. Network: egress (if telemetry exists)
7. Kernel/driver: only if evidence points below user mode

Win11 components to know (read-only first)

Extended curriculum — after Module 7

Three-tier maturity model

Security engineer lens — hardening checklist

Graduation criteria

You are ready to branch into attack-focused vault notes when you can without notes:

• Draw kernel vs user mode and the syscall path
• Explain imports/exports and why System32 bitness matters
• Name five high-value folders and what writes there
• Read a process row: parent, user, path, one loaded DLL
• List three persistence mechanisms and one tool for each
• Trace a script execution story through AMSI + Defender at a high level

Navigation

← Module 6 · Lab workbook → · MOC