B2: Enterprise Deep Ops
Windows Internals for Pentesters
Processes, tokens, handles, services, registry, LSASS, and why Windows privilege boundaries matter.
Windows exploitation becomes clearer when you understand access tokens, integrity levels, privileges, handles, services, named pipes, WMI, registry hives, and event logs.
- Tokens: user identity, groups, privileges, integrity level, and impersonation context.
- Services: executable path, service account, permissions, recovery actions, and writable directories.
- Registry: autostart locations, service config, LSA settings, stored secrets, and policy state.
- Processes and handles: what a process can open, duplicate, inject into, or read.
- Defensive sensors: PowerShell logging, AMSI, ETW, Sysmon, EDR userland hooks, and event IDs.