windows-internals

name

windows-internals

description

Windows operating system internals relevant for detection engineering — process creation chain (CreateProcess to token assignment), access token and privilege model (SeDebugPrivilege, integrity levels, UAC), DLL loading order and hijacking surface, service control manager architecture, COM/DCOM/WMI execution model, named pipe IPC, ETW provider landscape, AMSI architecture, registry hive structure, and the mapping between OS-level operations and the telemetry they produce. Use when authoring detections that need to understand WHY a behaviour is suspicious at the OS level, not just WHAT tool produces it.

Windows Internals — detection-relevant knowledge

This skill encodes how Windows actually works at the level needed to write detections that survive tool changes and evasion. It answers: "Why is this behaviour suspicious?" rather than "What tool name should I look for?"

---

1. Process creation chain

When a process is created on Windows, the following sequence occurs:

CreateProcess(W) API call
  → Kernel validates executable image
  → Access token assigned (inherited from parent or explicitly specified)
  → Primary thread created
  → DLLs loaded (ntdll.dll → kernel32.dll → application imports)
  → Process initialisation (TLS callbacks, DllMain for loaded DLLs)
  → Entry point executed

Detection-relevant implications

Concept	Why it matters for detection
Parent-child relationship	Every process has a parent. Anomalous parent-child pairs (e.g. excel.exe → powershell.exe) are high-signal.
Token inheritance	Child processes inherit the parent's access token by default. runas /netonly creates a new logon session with different network credentials — the process appears to run as the local user but authenticates to the network as someone else (Logon Type 9).
Command-line logging	The command line is set at creation time and cannot be changed after. However, ProcessCommandLine can be spoofed via NtQueryInformationProcess manipulation before the process starts executing — Sysmon EID 1 captures the original, not the spoofed version.
PID recycling	Windows reuses PIDs. A PID from January may be reused in February. Never correlate on PID alone — use ProcessUniqueId (Defender), ContextProcessId_decimal (CrowdStrike), process.storyline.id (SentinelOne), or process_guid (Sysmon/CBC).
Process hollowing	CreateProcess with CREATE_SUSPENDED → unmap original image → map malicious image → resume. The process appears legitimate by name but executes different code. Sysmon EID 25 (Process Tampering) detects this.

---

2. Access tokens and privileges

Every process runs with an access token that determines what it can do.

Token components

Component	Description	Detection relevance
User SID	Identity of the user	Account attribution
Group SIDs	Group memberships	Privilege group membership (Domain Admins, Administrators)
Privileges	Specific capabilities	SeDebugPrivilege = can open any process; SeImpersonatePrivilege = can impersonate tokens
Integrity level	Untrusted → Low → Medium → High → System	Determines what objects the process can access
Logon session	Links to the authentication event	Correlates process activity to authentication

Critical privileges for detection

Privilege	What it enables	Why attackers want it
SeDebugPrivilege	Open any process regardless of DACL	Required for LSASS memory access (credential dumping)
SeImpersonatePrivilege	Impersonate client tokens	Potato attacks (token impersonation for privilege escalation)
SeAssignPrimaryTokenPrivilege	Assign tokens to processes	Create processes as other users
SeBackupPrivilege	Read any file regardless of ACL	Read SAM/SYSTEM hives, NTDS.dit
SeRestorePrivilege	Write any file regardless of ACL	Overwrite protected files
SeTcbPrivilege	Act as part of the operating system	Full system compromise
SeLoadDriverPrivilege	Load kernel drivers	BYOVD (Bring Your Own Vulnerable Driver) attacks

Integrity levels

Level	Value	Typical processes	Detection implication
System	16384	SYSTEM services, kernel	Expected for services; unexpected for user-launched processes
High	12288	Elevated admin processes	UAC bypassed or legitimately elevated
Medium	8192	Standard user processes	Normal user context
Low	4096	Protected Mode IE, sandboxed	Sandbox escape if a Low process spawns a Medium+ child
Untrusted	0	Highly restricted	Should never spawn children

---

3. DLL loading and hijacking

DLL search order (standard)

When a process loads a DLL, Windows searches in this order:

1. Known DLLs registry (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs)
2. Application directory (where the .exe lives)
3. System directory (C:\Windows\System32)
4. 16-bit system directory (C:\Windows\System)
5. Windows directory (C:\Windows)
6. Current directory
7. PATH environment variable directories

Detection-relevant implications

Attack	Mechanism	Detection signal
DLL search order hijacking	Place malicious DLL in application directory before system directory	DLL loaded from unexpected path (not System32)
DLL side-loading	Abuse legitimate signed application that loads a specific DLL name	Legitimate executable in unusual location loading unsigned DLL
DLL injection	CreateRemoteThread + LoadLibrary in target process	Sysmon EID 8 (CreateRemoteThread), EID 7 (ImageLoad) from unexpected path
Phantom DLL loading	Application tries to load a DLL that doesn't exist — attacker places it	DLL loaded from writable location that doesn't normally contain it

---

4. Service Control Manager (SCM)

Windows services are managed by the SCM (services.exe). Key internals:

Concept	Detail	Detection relevance
Service creation	sc create or CreateService API → registry entry under HKLM\SYSTEM\CurrentControlSet\Services	EID 7045 (System) / 4697 (Security). PsExec creates PSEXESVC service.
Service account	LocalSystem, LocalService, NetworkService, or domain account	LocalSystem services have full system privileges. New services running as LocalSystem are high-signal.
Session 0 isolation	All services run in Session 0, isolated from user desktop	Services cannot interact with user desktop (since Vista). Attempts to do so are suspicious.
Service DLL	svchost.exe loads service DLLs from ServiceDll registry value	Malicious ServiceDll values pointing to attacker DLLs — persistence mechanism
Service failure recovery	FailureActions registry value can specify a command to run on failure	Persistence via failure recovery commands

---

5. COM/DCOM/WMI execution

COM (Component Object Model)

COM objects are registered in the registry and instantiated by CLSID. Detection-relevant:

• COM hijacking: Replacing a legitimate COM DLL with a malicious one via registry modification (HKCU\Software\Classes\CLSID\{...}\InprocServer32)
• DCOM lateral movement: Remote COM object instantiation via MMC20.Application, ShellWindows, ShellBrowserWindow — creates processes on remote hosts
• Detection signal: dllhost.exe spawning unexpected child processes; remote DCOM connections (RPC on port 135 + dynamic ports)

WMI (Windows Management Instrumentation)

WMI surface	Detection relevance
WMI process creation	Win32_Process.Create — creates processes remotely. Parent is WmiPrvSE.exe.
WMI event subscriptions	__EventFilter + __EventConsumer + __FilterToConsumerBinding — persistence mechanism. Sysmon EID 19/20/21.
WMI queries	SELECT * FROM Win32_Process — reconnaissance. High volume but specific queries (e.g. antivirus enumeration) are suspicious.

---

6. Named pipes

Named pipes are an IPC mechanism used extensively by Windows and by C2 frameworks.

Concept	Detail	Detection relevance
Pipe namespace	\\.\pipe\<name>	Sysmon EID 17 (PipeCreated), EID 18 (PipeConnected)
Default C2 pipes	Cobalt Strike: \\.\pipe\MSSE-*, \\.\pipe\msagent_*, \\.\pipe\postex_*	Known-bad pipe name patterns
SMB pipes	Named pipes over SMB (port 445) enable remote IPC	Lateral movement via named pipes (PsExec uses \\.\pipe\svcctl)
Pipe impersonation	Server can impersonate the client's token	Potato attacks use pipe impersonation for privilege escalation

---

7. ETW (Event Tracing for Windows)

ETW is the underlying telemetry framework that feeds Security events, Sysmon, and EDR sensors.

Provider	GUID	What it captures	Consumer
Microsoft-Windows-Security-Auditing	{54849625-...}	Security events (4624, 4688, etc.)	Security event log
Microsoft-Windows-Sysmon	{5770385f-...}	Sysmon events	Sysmon event log
Microsoft-Windows-PowerShell	{a0c1853b-...}	PowerShell execution	PowerShell event log
Microsoft-Antimalware-Scan-Interface	{2a576b87-...}	AMSI scan results	AMSI consumers
Microsoft-Windows-Kernel-Process	{22fb2cd6-...}	Process creation/termination	EDR sensors
Microsoft-Windows-DNS-Client	{1c95126e-...}	DNS queries	EDR sensors, Sysmon

Detection implication: Attackers who disable ETW providers (e.g. patching ntdll!EtwEventWrite) blind all consumers simultaneously. Detecting ETW tampering is a critical defence impairment signal.

---

8. AMSI (Antimalware Scan Interface)

AMSI provides a standardised interface for applications to submit content for malware scanning.

Concept	Detail	Detection relevance
AMSI providers	PowerShell, VBScript, JScript, .NET, Office VBA macros	Content scanned before execution
AMSI bypass	Patching amsi.dll in memory (AmsiScanBuffer → return 0)	Detectable via: PowerShell ScriptBlock logging showing bypass strings (AmsiUtils, amsiInitFailed), ETW provider tampering
AMSI evasion	String obfuscation, reflection, Add-Type compilation	ScriptBlock logging captures deobfuscated content — more reliable than command-line

---

9. Registry structure

Hive	Path	Detection relevance
HKLM\SOFTWARE	Machine-wide software config	Persistence (Run keys, COM objects)
HKLM\SYSTEM	System configuration	Services, drivers, boot config
HKLM\SAM	Security Account Manager	Local account hashes — credential dumping target
HKLM\SECURITY	LSA secrets, cached credentials	Credential dumping target
HKCU\SOFTWARE	Per-user software config	User-level persistence (Run keys, COM hijacking)
HKU\.DEFAULT	Default user profile	Persistence for services running as SYSTEM

Key persistence locations

Location	Registry path	Detection signal
Run keys	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	EID 13 (Sysmon), 4657 (Security)
RunOnce	...\RunOnce	Same — executes once then deletes
Services	HKLM\SYSTEM\CurrentControlSet\Services\<name>	EID 7045/4697
Scheduled tasks	HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache	EID 4698
COM objects	HKCU\Software\Classes\CLSID\{...}\InprocServer32	COM hijacking
Image File Execution Options	HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<exe>	Debugger persistence, accessibility feature abuse
AppInit_DLLs	HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs	DLL injection into every process loading user32.dll
Winlogon	HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	Shell replacement persistence

---

10. Quality checklist

• Detection targets the OS-level behaviour, not a specific tool name.
• Process correlation uses stable identifiers (not PIDs).
• Parent-child relationship validated against known-good baselines.
• Privilege requirements understood (e.g. SeDebugPrivilege for LSASS access).
• DLL loading detections account for search order, not just file name.
• Service creation detections check service account and image path.
• Named pipe detections cover both creation and connection events.
• Registry persistence detections cover both HKLM and HKCU paths.
• ETW/AMSI tampering considered as a defence impairment signal.
• Integrity level transitions validated (Low→Medium = sandbox escape).