Enter your search text in the box above

Select a result to preview

Lab Workbook — Windows 11 (192.168.50.114)

#windows #windows-11 #lab #procedure

Lab Workbook — Windows 11 (192.168.50.114)

Summary

One guided session on the lab VM that touches every module in the Win11 security engineering path. Copy-paste blocks; record results in your notebook.
Host 192.168.50.114
SSH ssh tester808@192.168.50.114 (password tester)
Hostname TESTER (observed 2026-09-01)
Build 10.0.26200 (Windows 11)
From MiniMac ICMP may fail; SSH TCP/22 works
Lab only

Do not disable Defender or patch system files for this workbook. Read-only inspection unless a module explicitly says otherwise.

Session 0 — Connect

From MiniMac (192.168.50.127):

ssh tester808@192.168.50.114

Pass: shell prompt returns; hostname prints TESTER.

Session 1 — OS baseline (Module 1)

Get-ComputerInfo | Select-Object CsName, WindowsProductName, OsBuildNumber, OsArchitecture
Get-Item C:\Windows\System32\ntoskrnl.exe | Select-Object Length, VersionInfo
Field Your result
Build
ntoskrnl version

Pass: build recorded; ntoskrnl.exe exists.

Session 2 — API gateway DLLs (Module 2)

'ntdll.dll','kernel32.dll','kernelbase.dll' | ForEach-Object {
  $p = Join-Path $env:windir "System32\$_"
  [PSCustomObject]@{ DLL=$_; Ver=(Get-Item $p).VersionInfo.FileVersion }
}

Pass: all three exist with version strings.

Session 3 — DLL inventory (Module 3)

'dll-target-selection' # reminder: full rubric in 00-dll-target-selection.md
'version.dll','amsi.dll','wldp.dll' | ForEach-Object {
  $p = Join-Path $env:windir "System32\$_"
  $sig = Get-AuthenticodeSignature $p
  [PSCustomObject]@{ DLL=$_; KB=[math]::Round((Get-Item $p).Length/1KB,1); Sig=$sig.Status }
} | Format-Table -AutoSize

Pass: three DLLs Valid signature; sizes recorded.

Follow-up reading: 00-dll-target-selection → 01-read-only-dll-inspection-amsi-part-1.

Session 4 — Folder map (Module 4)

@(
  $env:windir,
  "$env:windir\System32",
  "$env:ProgramData\Microsoft\Windows Defender",
  "$env:USERPROFILE\Downloads",
  "$env:APPDATA"
) | ForEach-Object { [PSCustomObject]@{ Path=$_; Exists=(Test-Path $_) } }

Pass: table filled; you can explain what each path is for.

Session 5 — Process census (Module 5)

Get-Process | Sort-Object WS -Descending |
  Select-Object -First 10 Name, Id,
    @{N='MB';E={[math]::Round($_.WorkingSet64/1MB,1)}}, Path

Get-Process -Id $PID -Module |
  Where-Object ModuleName -match 'ntdll|amsi|kernel32' |
  Select-Object ModuleName, FileName
Process Why it matters
MsMpEng Defender engine
explorer Shell

Pass: top 10 recorded; parent of PowerShell identified via CIM (Module 5 command).

Session 6 — Services and autoruns sample (Module 6)

(Get-Service | Where-Object Status -eq 'Running').Count

Get-ScheduledTask |
  Where-Object State -eq Ready |
  Select-Object -First 5 TaskName, TaskPath

Pass: running service count recorded; opened services.msc or Autoruns64 once (C:\Tools\Sysinternals\Autoruns64.exe).

Session 7 — Research tools (GUI — RDP or console)

Procmon and ProcExp are GUI tools — use RDP/local console on .114, not headless SSH.
  1. Launch Process Explorer (procexp64.exe) as Administrator.
  2. Find powershell.exe → lower pane → confirm amsi.dll and ntdll.dll loaded.
  3. Launch Process Monitor → filter Process Name is powershell.exe → run a simple command → stop capture.
  4. Verify Sysmon:
Get-Service Sysmon64
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 3 |
  Select-Object TimeCreated, Id

Pass: ProcExp DLL list captured (screenshot or notes); Sysmon Operational shows Event ID 1 (process create).

Full tool reference: Sysmon first hunt workbook · Tools inventory.

Session 8 — Security map recap (Module 7)

Answer in your notebook (no command):

  1. Where does a PowerShell script hit AMSI in the stack?
  2. Name the process that owns real-time scanning on this host.
  3. What is the syscall gateway DLL?

Pass: three answers align with Module 7.

Exit checklist

← MOC · Module 7