Endpoints and Systems

description

This track provides an overview of the common endpoint OS's, including Windows and Linux, and will
build familiarity with endpoint security deployment.

Understanding Windows Operating System Basics

Introduction

In this section, you'll learn about Windows Operations and Terminologies that will be relevant when
you're investigating a security incident and need to understand what you're looking at. You'll learn about
Windows operating system basics through a mixture of animated videos, content review questions, a lab,
and a summary challenge. This section will take about three hours to complete.

It's important that you understand WMI and how it can help you monitor your Windows devices. It's also
important that you secure WMI access since hackers can use it to carry out commands. In this section,
you'll explore several Windows services, structures, and tools that are a part of the Windows
architecture. At the end, you'll learn about common third party tools and then see the implementation
of the topics discussed. Let's learn more about understanding Windows operating system basics.

The three most used endpoint operating systems are Windows, Linux, and Mac. When investigating
security incidents, security analysts often encounter these operating systems running on servers or user
end hosts. This section covers basic Windows operations principles.

Before an analyst investigates Windows security incidents, it is important that they understand some of
the basic operations of the Windows operating system and how to examine the Windows event logs. The
content in this section assumes that you already understand how to use various Windows operating
systems, and introduces basic internal Windows operations and terminologies.

Windows Operating System History

Microsoft Windows has been a family of operating systems for personal computers since 1985. Windows
was originally designed for desktop computing. Windows 1.0 was built as a comprehensive graphical
user interface for the MS-DOS operating system in November of 1985. Well, from there, we saw
Windows 3.1 and 3.1 for Workgroups. That Windows operating system began to diverge between a
personal computing system and an enterprise class operating system.

Well, this led to Windows NT, Windows 95, Windows NT 4.0, Windows 98, and so on. As you can see, in
addition to Windows operating systems that are designed for personal computers, Microsoft also offers
operating systems for servers as well. Microsoft also offers operating systems for mobile phones and
personal mobile devices.

Now, the latest Windows operating system is Windows 10, which is the successor to Windows 8.
Windows 10 debuted in 2015, and the most recent version of Windows Server is Windows Server 2016,
which became available in October of 2016. And the operating system itself has become a very robust
enterprise platform that ranges in its use from everyday desktop environments to data center scale
platforms.

Its architecture has matured over the years. There are new features that provide system stability and
security. And when you couple that with a large base of technical professionals who are familiar with the
operating system and with the Windows based infrastructure, this makes it a very popular platform for
computing.

Now, as a security analyst, you definitely need to be familiar with how Windows operates and be able to
research the known vulnerabilities. To do this, you're going to visit the National Institute of Standards
and Technology, or NIST website. When you visit the NIST website at [Link], you'll search for the
term "vulnerabilities," which will provide the NVD search result. Clicking on that takes us to
[Link], which allows you to search the CVE and CCE vulnerability database. Being able to
navigate and search this database for current Windows operating system vulnerabilities is an essential
task of one who works in a network security operation center.

Microsoft Windows has been a family of operating systems for PCs since 1985. In addition to Windows
operating system for PCs, Microsoft offers operating systems for servers and personal mobile devices.
Originally developed by Microsoft for IBM, MS-DOS was the standard operating system for IBM-
compatible PCs. The latest Windows operating system is Windows 11 (the successor to Windows 8),
which debuted on October 5, 2021.

It is interesting to note that although Microsoft operating systems have several vulnerabilities, they are
not in the top three, as shown below.

Operating System Vendor Number of Vulnerabilities

Debian Linux Debian 3067

Android Google 2563

Linux Kernel Linux 2357

Mac X Apple 2212

Ubuntu Linux Canonical 2007

IPhone Apple 1655

Windows Server 2008 Microsoft 1421

Windows 7 Microsoft 1283

Windows 10 Microsoft 1111

Windows Server 2012 Microsoft 1050

Note
Go to [Link] CVE vulnerability data are taken from
National Vulnerability Database (NVD) XML feeds provided by National Institute of Standards and
Technology (NIST).

Content Review Question

Correct

When you are researching a Windows operating system vulnerability (such as CVE-2016-7211), which
organization can provide detailed information about the specific vulnerability?

Institute of Electrical and Electronics Engineers (IEEE)

 Control Objectives for Information and Related Technologies (COBIT)

 National Institute of Standards and Technology (NIST)

 International Organization for Standardization (ISO)

Answer

The correct answer is National Institute of Standards and Technology (NIST).

Content Review Question

Correct

Which is not a valid Windows operating system version?

Windows 10

 Windows 9

 Windows 8.1

 Windows 8

 Windows 7

 Windows Server 2012

 Windows Vista

Answer

The correct answer is Windows 9.

Windows Operating System Architecture

The Windows operating system architecture consists of two major components: user mode and kernel
mode. User mode is the component that manages processes on behalf of system users. When a user
starts an application, Windows creates the application process in user mode. This user mode process
runs at a lower privilege level and does not directly access or interface with system level processes.
These processes have their own memory space and that prevents one user's process from gaining access
to another user's process.

There is a mechanism, however, for a user process to request a resource from another, but this is
handled through specific API calls that are controlled by the operating system. All in all, the idea here is
that operating in user mode reduces the potential for corruption of the system. Each application has its
own virtual address space that's private, and the application runs in isolation.

There are different categories of processes that can run in user mode. Non-service processes support
user access to the system resources such as log on services and session manager. These are services that
are initiated by user activity and not started by the Service Control Manager. Service processes are
services that run in support of user system requirements such as the print spooler. Service processes are
generally initiated by the system through the Service Control Manager and run ahead of the user activity.

If a user wants to print, they shouldn't have to wait for the print spooler to start before they can print. It
should already be running and ready to service their request. Now, the other component mentioned was
kernel mode. User mode applications and services often need to use resources that are managed by
kernel mode processes. For example, a user process may need to write to a file or initiate a network
connection. To support user application requirements, Windows can allow processes to switch contexts
from user to kernel mode when executing a kernel mode operation.

When the operation requiring the system level resource is completed, it switches context again back to
user mode. This context switching is handled by a kernel interface layer. User mode processes can't
directly access system level resources. And understanding this behavior can help you to identify
malicious applications that attempt to switch context into kernel mode for elevated privileges on a
system.

Kernel mode is the component where the core processes of the operating system run. And if a malicious
application gains access to these processes, it can cripple a machine rendering it unusable. If a kernel
mode driver writes to the wrong virtual address, data that belongs to the operating system or another
driver could be compromised. If a kernel mode driver crashes, the entire operating system crashes.

Now, Windows Vista and later versions of Windows enforce kernel mode code signing, which means that
the drivers and critical system files have to be signed with a cryptographic key that comes from a public
CA. Now, that CA has to be authorized by Microsoft to issue those certificates. And this is designed to
assure that all the code that's processed in kernel mode can be traced back to the owner of the code.

The Windows operating system has evolved into a robust enterprise computing platform that ranges in
use from everyday end-user desktop environments to data center-scale server platforms. Its architecture
has matured to include features that provide system stability and security. Although Windows is used
most often as a desktop computing platform, its server platforms are used extensively in corporate data
centers by IT professionals.
The figure illustrates the various architectural components of the Windows operating system, and
outlines major processes that each component handles.

The Windows operating system operating system’s architecture is common across all its offerings and
consists of two major components:

 User mode: The component that manages processes on behalf of system users. It runs with
lower privilege so users can’t directly interfere with system level processes. It also provides
communication pathways known as APIs so that user processes can request access to system
level resources.

 Kernel mode: The component in which the core processes of the operating system run. Its
processes run with the highest level of privilege so it can manage system CPU and memory
resources.

The list does not include all the elements for each component, but it does outline the major processes
and which mode is responsible for each. One of the concepts of the Windows architecture is how
processes are treated relative to the mode in which they reside. For example, user processes appear to
occupy their own distinct spaces, which roughly equate to the memory resources that the operating
system dedicates to each one, preventing a user mode process from accessing the memory space of
another process. This mechanism enhances the security and stability of the system.

Kernel mode processes also operate within the same memory space. However, kernel mode processes
are higher privileged functions that cannot be directly accessed by lower privileged user mode
processes. Executing processes in the same memory space increases the overall efficiency of the system.

User mode and kernel mode processes are the Windows subsystems that form the core of the operating
system. They are started at system initialization by the Session Manager ([Link]). The following
registry key will identify the system’s operating mode HKLM\SYSTEM\CurrentControlSet\Control\Session
Manager\SubSystems.

User Mode
User mode processes are specific processes that are initiated or owned by Windows users. User mode
processes operate within the confines of their own memory space or spaces, which prevent one user’s
process from accessing another user’s process space or resources. The system does provide ways for one
user process to request resources from another: Specific API calls are tightly controlled by the system,
which prevents a process from arbitrarily impinging on another user’s process space while reducing the
potential of system corruption. Remember, user mode processes operate at lower system privileges than
kernel mode processes to maintain the separation between the user and kernel mode spaces.

The types of processes that run in user mode can fall into one of four general categories:

 Non-service processes: Fixed processes that support user access to system resources such as
login services and Session Manager. Non-service processes are not services in a strict sense
because they are initiated by user activity and not started by the service control manager.

 Service processes: Services that run in support of user system requirements; they are not system
services that run independent of users, and are generally initiated by the system through the
service control manager. Some examples include the Task Scheduler and Print Spooler.

 User applications: As the name implies, processes that are needed to run applications that are
initiated by users.

 Operating system environment support: Windows NT originally shipped with support for
Windows, OS/2, and POSIX subsystems to support a Windows design goal of code portability.
Recent versions of Windows have dropped support for OS/2 and POSIX in favor of an enhanced
version of POSIX that is called Subsystem for UNIX-based Applications (SUA). The operating
system environment support subsystem manages the subsystem components to use based on
what is required by running applications.

User mode applications and services often need to utilize resources that are managed by kernel mode
processes. For example, a user mode process may need to write to a file or initiate a network
connection. To support user application requirements, Windows can allow a process to switch contexts
from user to kernel mode. When the operation requiring the system level resource completes, the
system will switch the context back to user mode. This function is handled by a kernel interface layer
that manages context switches and will prevent user mode processes direct access to system level
resources.

Kernel Mode

A large portion of the Windows operating system runs as kernel mode processes. Unlike user mode
processes, where each process runs in its own protected memory space, kernel mode processes share
the same memory space. Kernel mode processes provide speed and efficiency, along with the
opportunity for a misbehaving process to potentially impact the entire system. To mitigate this
possibility, Windows enforces kernel mode code signing, which means that drivers and critical system
files must be signed by a cryptographic key from a public certification authority.

Major processes that run in kernel mode include the following:

 Kernel executive: Performs base operating system services such as I/O, networking, and memory
management
  Kernel: Responsible for managing low-level system operations such as thread scheduling and
managing system interrupts

 Device drivers: Handles the requests for I/O to and from connected hardware devices

 Hardware abstraction layer (HAL): A layer of operating system code that handles interaction
between the kernel and hardware to account for differences between platforms such as
motherboards. HAL allows the operating system to be insulated from the hardware so that the
operating system itself does not need to adapt to hardware differences. Rather, the HAL handles
low-level hardware contingencies by translating them to standard operating system functions.

 Window management and graphics subsystem: Implements the GUI and manages graphic
functions for Window management and interface controls

 [Link]: Windows executive and kernel

 [Link]: HAL module

 [Link]: Kernel-mode device driver for managing Windows displays and screen output. Also
collects input from devices such as the keyboard and mouse

 [Link]: System service dispatcher to executive

 [Link]: Kernel interface core Windows subsystem

 [Link]: Core Windows subsystem

 [Link]: User-mode management subsystem

 [Link]: GUI management subsystem

Content Review Question

Correct

Malicious Windows operating system codes that share a single virtual address space, and can manage
the system CPU and memory resources directly are running in which mode?

safe

 user

 kernel

 privileged

Answer

The correct answer is kernel.

Content Review Question

Correct
Which type of Windows processes operate within the confines of their own memory space?

service

 EXEC

 user

 kernel

 privileged

Answer

The correct answer is user.

Content Review Question

Correct

When investigating Windows-based security incidents, which can cause the most damage to the integrity
of the Windows operating system?

malicious Windows drivers that run in kernel mode

 malicious applications that run in kernel mode

 malicious applications that run in safe mode

 malicious rootkits that run in user mode

Answer

The correct answer is malicious Windows drivers that run in kernel mode.

Windows Processes, Threads, and Handles

A Windows application consists of one or more processes. But what's a process? Well, a process, to be
put in simple terms, is just an application that is executing. Now a process runs in a virtual address space
and it consists of executable code. Each process has a unique identifier, a priority class, it uses
environmental variables, and so on. Each process also has a security context, such as the user mode
context, which initiated the process. And this helps to keep that application isolated. Now each process
has an associated minimum working set size and maximum working set size that govern the use of the
virtual memory that it's using.

Now we can look at our processes on a Windows device by accessing the Task Manager. To access Task
Manager on a Windows client, right click on the task bar and select Task Manager. You can see here on
our Windows 10 client that that is open, Task Manager. Right now we have a single task running and
that's Microsoft Edge. Now we click on More Details. Now we can see all of those processes. Now there
are background processes that are running. We actually have processes from the applications that we
just launched running as well.

Now each of these processes is started with a single thread, and that's called the primary thread. But the
process can create additional threads from that primary thread, or any other thread for that matter. And
a thread is just the most basic unit in which the operating system is allocating processor time. So an
application might start a new thread to perform some function and it's going to need processor time to
be able to do that. Now all of the threads of a specific process are going to share virtual address space
and system resources of the primary process. In addition, each thread maintains exception handlers, a
scheduling priority, a thread local storage, a unique thread identifier, and a set of structures that the
system will use to save the thread context until it's scheduled.

Now Windows itself supports preemptive multitasking. What that means is that we can simultaneously
execute multiple threads for multiple processes at the same time. That's why we have multiprocessor
multi-core computer systems these days. Now because of that, with a multi-processor system we can
execute as many threads as we have processes on that computer.

Now going back to our applications running as a process, another term that we want to understand is an
object. Well, what's that? Well, this is the term that we use to represent the resources that our
applications are going to interact with. It could be a file. It could be a thread. It could be a graphic. When
an application wants to interact with these resources, it can't do so directly. It has to reference an object
handle. And that object handle is going to give it the means to access the resource, as well as the
location of the resource.

So these things all work together. We have an application that initiates a process. The process can then
run multiple threads. Each thread might be performing a different function. When we want to access
resources, we need to do that through an object handle. The object handle will then give me the
location and the means to access that resource.

A Windows application consists of one or more processes. In the simplest terms, a process is an instance
of an executing program.

One or more threads run in the context of the process. A thread is the basic unit the operating system
allocates processor time to. A thread can execute any part of the process code, including parts currently
being executed by another thread. Each process provides the resources to execute a program and
contains the following characteristics:

 Runs in virtual address space

 Consists of executable code

 Opens handles to system objects

 A security context

 A unique process identifier

 Environment variables

 A priority class
  Minimum and maximum working set sizes

 At least one thread of execution

Each process is started with a single thread that is often referred to as the primary thread. However, the
process can create additional threads from any of its existing threads.

A thread is the entity within a process that can be scheduled for execution. All threads of a process share
its virtual address space and system resources. In addition, each thread maintains exception handlers, a
scheduling priority, thread local storage, a unique thread identifier, and a set of structures the system
will use to save the thread context until it is scheduled. The thread context includes the thread's set of
machine registers, the kernel stack, a thread environment block, and a user stack in the address space of
the thread's process. Threads can also have their own security contexts, which can be used for
impersonating clients. All threads within a process can access its virtual address space. In general,
threads cannot access the memory space that belongs to another process, protecting the process from
being corrupted by another process.

Microsoft Windows supports preemptive multitasking, which creates the effect of simultaneous
execution of multiple threads from multiple processes. On a multiprocessor computer, the system can
simultaneously execute as many threads as there are processors on the computer.

An object is a data structure that represents a system resource, such as a file, thread, or graphic image.
An application cannot directly access object data or the system resource that an object represents.
Instead, an application must obtain an object handle, which it can use to examine or modify the system
resource. Each handle has an entry in an internally maintained table. These entries contain the addresses
of the resources and the means to identify the resource type.

Windows Task Manager

The Windows Task Manager can be used to view the running applications and processes.
Here are two ways to start the Windows Task Manager:

 Right-click the taskbar and choose the Start Task Manager option.

 Run the taskmgr command from the Windows command line.

Content Review Question

Correct

Which Windows component is used by the applications to modify the system resources?

process thread

 task manager

 Windows registry

 object handle

Answer

The correct answer is object handle.

Content Review Question

Correct

When investigating a malicious Windows application, which two Windows components that are
associated with the application will also need to be investigated? (Choose two.)

threads

DLLs

processes

kernel object handles

Answer

The correct answers are threads and processes.

Windows Virtual Memory Address Space

So you'll recall that we have RAM. And then we run an application and the application is going to call
RAM when it needs to do anything. So they get access to RAM, and they make system calls, and they
access TCP/IP ports and windows sockets and all of that good stuff. But we only have so much RAM in a
device. And so once that RAM starts to run out, we need to do something so that that application still
has memory to be able to run its functions.

So this is where virtual memory comes in. Now, virtual memory is an allocated amount of physical
memory that is on our hard drive. So it's not physical memory in terms of being RAM, what it is it's using
that physical hard drive and a small slice of it to act as RAM when we don't have enough RAM to execute
the application's functions.

Now, normally, we want to use as much RAM as possible and as little virtual memory as possible. So
hardware is going to be faster than software. When we're operating out of virtual memory, the operating
system in software is handling the calls to that virtual memory.

Now, the disk space that is used to hold this virtual memory is known as a paging file. Now, pages are
just a unit of memory that gets swapped between the physical memory and this paging file on the hard
drive by the Windows Virtual Memory Manager. Now, there's a virtual address space that's used, that's
how we're able to locate it. The virtual address doesn't actually represent an actual physical location of
an object that's in memory, but instead, the system has this Page Table for each process. And that has
the internal data structure that's used to translate the virtual address into the corresponding physical
address on that drive.

In modern computing systems, temporary data instructions that are processed by the CPU are stored in
the computer’s RAM. Virtual memory is a memory management technique that helps the system
execute programs when the environment is running low on RAM memory. Virtual memory temporarily
transfers content directly from RAM into the disk storage system. This process helps to compensate for a
shortage of RAM.
A process is allocated specific memory addresses from the available virtual address space. The address
space for each process is private and cannot be accessed by other processes unless it has permission to
open the process for read or write access. All Windows applications and processes have to be granted
specific access to various kernel system resources or objects, such as TCP ports and Windows sockets. By
design, processes are not allowed direct access to kernel level functions. A process handle provides the
process with access to a specific kernel level resource. Typically, the process has to release the handle for
other processes to be able to access the same kernel level resource. However, if the process has kernel
level access to a function and the handle has granted PROCESS_VM_READ (function) access, other
processes can be granted read access to the same kernel level function’s memory space via the
ReadProcessMemory function. In addition, if the process has kernel level access to a function and the
handle has granted PROCESS_VM_WRITE (function) access, other processes can write to the same kernel
level function’s memory space via the WriteProcessMemory function. It should be noted that processes
need SeDebugPrivilege to open such handles. This potential violation of the process's memory privacy is
very common when dealing with malware, and is a technique that is used to insert malicious code with
the intent of gaining access to a system.

A virtual address space does not represent the actual physical location of an object in memory; instead,
the system maintains a page table for each process. The page table is an internal data structure used to
translate virtual addresses into corresponding physical addresses. Each time a thread references an
address, the system translates the virtual address to a physical address.

Each process on 32-bit Microsoft Windows supports a virtual address space that enables addressing up
to 4 gigabytes of memory. Each process on 64-bit Windows supports a virtual address space of 8
terabytes.

Content Review Question

Correct

Malware that can corrupt the virtual memory space of another process can alter the content of which
two resources? (Choose two.)

another process’s content stored in the RAM

another process’s content stored in the hard disk

another process’s content stored in the BIOS

another process’s content stored in the NVRAM

Answer

The correct answers are another process’s content stored in the RAM and another process’s content
stored in the hard disk.

Content Review Question

Correct

What condition does the size of the total addressable virtual memory space depend on?

if the Windows version is a server version

 whether the Windows version is 32-bit or 64-bit

 the drivers that are loaded with the Windows version

 the physical size of the hard disk

 the size of the RAM

Answer

The correct answer is whether the Windows version is 32-bit or 64-bit.

Windows Services
Services in Windows are long running, executable applications. They run their own Windows sessions.
They can be automatically started when the computer boots up. And they can be paused, restarted, and
controlled in what's known as the Service Control Manager.

And we're looking at that right now. Let's go into our Windows Operating System. And let's just take a
look at how we would access this Service Control Manager using our Windows interface. So first, we'll
give you the example of how to access our services in a Windows server.

Here, we're on Windows Server 2012 R2. And very simple way to access it is to go to our little Start
option and simply type in [Link] and hit Enter. And this will open our Services Manager for us.
Now from here, we can access specific services.

For example, here's our Active Directory Certificate Services. And if we double-click click on that, we can
see that we have the ability to control these services. So right now, it is set to start automatically. And it
is started.

Right now it tells us that it's running. We can stop the service, pause the service, and then we can even
use this dropdown to control the startup type, whether it's not going to start automatically or whether
it's going to automatically start but delay the startup. Or maybe we want to disable it for some reason.
We have control right here in our Services Manager.

Now, we have the Logon option. This is a local system account. That's what's going to be used to run it.
We have a Recovery tab that tells us what to do if this service were to fail.

So keep in mind that these services that are running are applications. Applications sometimes have
problems. And so the application might crash. Maybe we're interacting with it the wrong way.

So the service crashes, what do we do? This is where we get to decide that. And then we have
dependencies. Now some of our services are going to depend on other services. Just like an application
might run multiple threads and one thread might use another thread to access resources, same thing is
kind of true here. We have services that are running. Those are applications.

And those applications might need another service to be running to function properly. Case in point, let's
go over to our Windows Client. So here in our Windows Client, we're looking at Service Control Manager.
And this the AnyConnect Network Access Manager. And if we go to Dependencies here, we can see that
it requires the wireless LAN AutoConfig service to run so that it functions properly.

Microsoft Windows services (formerly known as NT services) will create long-running executable
applications that run in their own Windows sessions. These services can be automatically started when
the computer boots. These services can be paused and restarted, and do not show any user interface.
These features make services ideal for use on a server or whenever you need long-running functionality
that does not interfere with other users who are working on the same computer.
Services Control Manager is used to start, stop, pause, resume, and configure the services.

To start Services Control Manager using the Windows interface, complete these steps:

1. Click the Start button.

2. Click Control Panel.

3. Click Administrative Tools.

4. Double-click Services.

To start the Services Control Manager by using a command line, open a Windows command prompt and
enter the [Link] command.

Content Review Question

Correct

You encountered malware that automatically runs upon bootup in its own Windows sessions, and
without any user interface. Which Windows component can be used to configure the malware from
starting automatically?

startup manager

 performance manager

 services control manager

 device manager
Answer

The correct answer is services control manager.

Content Review Question

Correct

Referring to the following figure, which statement is correct?

The Adobe Acrobat Update Service will automatically start during the boot and login process.

 BitDefender Threat Scanner is running in the background.

 Bluetooth Support Service has been disabled.

 Cisco AnyConnect Secure Mobility Agent was started manually.

Answer

The correct answer is The Adobe Acrobat Update Service will automatically start during the boot and
login process.
Windows File System Overview

In terms of our Windows File System, you look at an operating system, and the user data is typically
stored on a hard disk. Now, more and more these days, we see solid state drives being used.

Now, within that, there are different types of file systems that can be used. We have the File Allocation
Table, or what we would call FAT. We have exFAT, we have HFS+, or Hierarchical File System Plus, and
then we have Extended File System, or EFS. And, of course, we have to mention the New Technology File
System, or NTFS.

So let's take a look at each one of these. Now, FAT, or File Allocation Table, is a general purpose file
system. It's used by Windows, Mac OS, and Linux. It's often the default for USB media if you had a little
thumb drive.

And it does impose some file size limitations, so because of that fact, more and more today we don't see
FAT being used as often. Now, we might see FAT16, but it's more common to see FAT32 as the actual type
that we would use. Now, there's also exFAT, which stands for extended FAT. It removes that size
limitation, so that's what's been extended about it, but it's not widely supported so not very popular.

We have the Hierarchical File System Plus, or HFS+. This is used on Mac OS, a very common file system. It
supports long file names. You can have 255 characters in a file name, so they can be pretty long. And if
Windows is going to read this type of file system, you're going to have to install some additional
software.

Now, there's also the Extended File System, or EFS. This is the default for Linux. The current version is
EXT4. And again, for Windows to be able to read this, you're going to need some additional software
installed on a Windows operating system.

Now, New Technology File System, or NTFS, is the most commonly used file system on a Windows
installation, and it is natively supported across all versions of Windows and Linux, so that's a good thing.
On a Mac OS, it's read-only, unless you were to add some additional software to a Mac, and then you'd
be able to write to an NTFS file system.

Now, one of the neat things about NTFS is the alternate data streams capability. Now, this feature is very
interesting, especially in terms of security because it is a way to actually hide data. Now, the ADS data is
not easily visible if you were to look at a file, and it can also make it really hard to detect this data that is
hidden in this ADS, or Alternate Data Stream. So let's go to the command line and look at how we can
work with this Alternate Data Stream. And we'll just show you how easy it is to hide some information.

OK, so the first thing that we're going to do to demonstrate the alternate data stream is we're going to
create a text file. And we'll just do this from the command line. And the way that we do that is with the
echo command. So we're going to echo some text-- This is my text file. And then I'm going to echo that
into [Link].

Now, we have a new sample text file, and inside of it it should say, "This is my text file." So now how do
we verify that that's the case? Well, what we can do is type [Link], and there we go. That's the
contents of that text file.
Now, if we do a DIR, we should see that sample text file. And if we do, more specifically, dir [Link],
we can actually see that that is a single file, and it is 22 bytes. Now, we can even do notepad [Link],
and we could open that up, and there we go. We can see this is my text file. Let's close that.

And now let's start hiding some data. So the way that we're going to do that is use that echo command
again, so we'll say echo, and then we're going to say you can't see this data. And we're going to echo that
into [Link], only now, to put this into the alternate data stream, we're going to use a colon, and then
we're going to put that into [Link].

OK, so now how do we see what's happened here. Well, first let's do a DIR on [Link]. And you'll
notice it still shows that this is 22 bytes. Now let's do a notepad on [Link] colon [Link]. And now
we can see that alternate datastream where we echoed in the sentence, "You can't see this data."

So again, let's close this. Let's do a DIR. And when we look into the directory, we do not see a file called
[Link]. It's in the alternate data stream of the file [Link]. So when I say that it's difficult to see
this, when you do a directory listing, you don't see it. It's hidden from us. Even though the data is there
and readable in Notepad, if we open it and reference that alternate data stream, the file size has not
increased at all.

Now, what would happen if we echoed more data into it? OK, so let's just look at the directory listing.
We see right now the size on the disk ends with 336. And what we're going to do is we're going to echo
some more data into our data stream.

Let's echo into that sample text file. The words "this is hidden." So we'll just paste that here. We're going
to copy it. And then we're going to keep pasting this several times until we have quite a bit of data that
will increase the file size, which will reduce the number of bytes free on the disk overall.

Let's do a CLS and clear our screen. And then let's go ahead and do a DIR. And we can see now the file
size of [Link] is still 22 bytes. However, we can see that the number of bytes free on the disk has
decreased. So the file size did change.

If we Notepad on [Link] [Link], we should see all that hidden data that we entered in there into
the alternate data stream, which is now hidden from view. While it decreases the number of bytes free,
we still don't see it easily when we do a directory listing here. And again, this is why it's so important to
understand this alternate data stream. If you're working in a SOC, you're going to be analyzing things like
this. And if an attacker can enter information into that alternate data stream, then there's a potential it
could be executable data and a way for them to release malware into the environment.

The Microsoft New Technology File System (NTFS) is predominantly utilized in most Windows
installations today. A file system is a mechanism for organizing files on storage media. The type of media
may influence which file system is appropriate to use. For example, optical media typically uses ISO 9660
or UDF. The focus of this section is on disk storage since the operating system and user data are typically
stored on hard disk media.

The following file system options are supported in Windows installations:

 File Allocation Table (FAT): A general-purpose file system that is supported by Windows and
other operating systems such as Mac OS X and Linux. Because of its simplicity and portability, it
remains a popular file system. It is mostly used as the default format for USB-based storage
 media such as flash drives. However, it does have some limitations in terms of the file sizes it
supports and the maximum partition size, so it is not widely used for hard drives. There are
varieties of FAT known as FAT16 and FAT32. The FAT32 variant is the most commonly used
because it is the least restrictive of the variants, less than FAT16.

 exFAT: The extended version of the FAT file system removes some of the file and partition size
limitations of FAT, but is not widely supported on operating systems other than Windows and
later versions of Mac OS X.

 Hierarchical file system plus (HFS+): The file system that is used on Mac OS X-based systems.
HFS+ permits filenames up to 255 characters in length and supports larger file sizes and drive
partitions than the original HFS. It is not supported on Windows platforms without the aid of
additional software. However, a Windows system can read data from an HFS-formatted drive.

 Extended file system (EXT): The default file system on Linux-based installations. Its most current
version is EXT4, which has the benefit of maintaining backward compatibility with the previous
versions 2 and 3. It is not natively supported on Windows platforms, but a Windows system can
read data from EXT-formatted drives with additional software.

 Microsoft NTFS: The most commonly used file system in Windows installations. It is natively
supported across all versions of Windows and Linux operating systems. Mac OS X-based systems
can read NTFS partitions but can only write to them by installing additional driver software.

NTFS Basics

Microsoft NTFS provides many features that make it a good choice for both enterprise-scale systems and
desktop systems. Some key features are:

 Performance and reliability

 Compatibility

 Large file and partition size

 Disk quotas

 Recovery features

 Security

 It also supports file system encryption to further secure data at rest on the storage media. NTFS
supports data access control through security descriptors that include file ownership and
permission characteristics for each file. This capability is one reason that NTFS is used so
extensively throughout Windows deployments.

NTFS Volume Structure

Formatting a drive with the NTFS file system creates several system files, and the basic structures for
reading and writing files and recording their locations.

Partition Boot Sector Master File Table System Files File Area
The partition boot sector occupies the first 16 sectors of the drive. It contains information that points to
the system bootstrap instructions and the location of the Master File Table (MFT), which contains an
index of all the files on the partition. The last of the 16 sectors is a copy of the boot sector, which can be
referenced if the primary is corrupted.

The MFT contains a file that maps the location of all the files and directories on the partition. NTFS also
maintains a mirror or copy of the MFT that can be used if the primary is corrupted. In addition to file
location, the MFT stores file attributes such as filename, security descriptor, and time stamps.

The system files are created when the NTFS volume is first initialized. These files are hidden and are used
to store metadata about files, NTFS volumes, logs, and file attribute definitions.

The file area is where the files and directories are stored.

NTFS Alternate Data Streams

An interesting feature of the NTFS file system is the alternate data streams (ADS) technique. Files in NTFS
are stored as a series of attributes such as the filename and date stamp. One attribute is called $DATA,
which represents the actual file data, and is known as a data stream. However, NTFS allows you to attach
ADSs to a file that provides for various interesting cases. ADSs are primarily used by applications to store
additional information about a file.

ADS data is not readily visible and can be difficult to detect. In fact, recent versions of Windows just
started providing tools for identifying files with ADS. A file with ADS can be referenced with the following
format:

[Link]:ADS<name>

In the example below, the base filename is [Link]. The colon character (:) separates the base
filename from the name of the ADS, which is ADStest. To test this feature, you can easily create a file
with an ADS as follows:

C:\Users\Ed\test>echo "My ADS data." > [Link]:ADStest

This command sends the text that is specified in the echo command to an ADS that is associated with a
file called [Link]. List the files in the directory with the dir command to confirm that the file was
created.

C:\Users\Ed\test>dir

Volume in drive C has no label.

Volume Serial Number is 4428-917B

Directory of C:\Users\Ed\test

09/09/2019 11:20 AM <DIR> .

09/09/2019 11:20 AM <DIR> ..

09/09/2019 11:20 AM 0 [Link]

 1 File(s) 0 bytes

2 Dir(s) 18,152,321,024 bytes free

C:\Users\Ed\test>

Note that the [Link] file exists, but the size of the file is 0 bytes. The reason is that the data that was
entered into the file did not go to the primary data stream, which is what the dir command is reporting.
Instead, it went to an alternate data stream that is called ADStest.

To see the data that you put into the alternate stream, do the following:

C:\Users\Ed\test>more < [Link]:ADStest

“My ADS data.”

C:\Users\Ed\test>

The exercise illustrates an important ADS issue: It is easy to hide things in an ADS. This technique has
been used for malicious purposes, so it is important to be aware of it. Recent versions of Windows have
added tools to help administrators identify the presence of ADS. For example, the dir command now
includes support for the /r parameter, which lists the ADSs that are associated with a file. Consider the
following example:

C:\Users\Ed\test>dir /r

Volume in drive C has no label.

Volume Serial Number is 4428-917B

Directory of C:\Users\Ed\test

09/09/2019 11:20 AM <DIR> .

09/09/2019 11:20 AM <DIR> ..

09/09/2019 11:20 AM 0 [Link]

17 [Link]:ADStest:$DATA

1 File(s) 0 bytes

2 Dir(s) 18,157,400,064 bytes free

C:\Users\Ed\test>

Note that the dir command with the /r parameter is now reporting the presence of the ADS attached to
the file. Also note that the byte size of the ADS is also being reported and that the byte size of the file
remains 0.

Content Review Question

Correct

When performing disk forensics on a Windows machine, which file system will most likely be involved?
FAT

 HFS+

 EXT

 NTFS

Answer

The correct answer is NTFS.

Content Review Question

Correct

Which part of the NTFS formatted disk drive can be damaged by corrupting the first 16 sectors of the
drive?

master file table

 partition boot sector

 system files

 file area

Answer

The correct answer is partition boot sector.

Windows File System Structure

Well in general, the Windows file system is stored on what we would call the C drive. And so we can see
that here-- C:\. And then underneath that, you would have several folders that would contain different
files.

And this is in a general installation. Now, the boot directory is a hidden directory. And that contains our
boot files. We have the logs directory that stores our event logs. And we're going to find that on
Windows 10. Prior to that, we didn't have that Logs folder.

We have the PerfLogs which stores our performance logs if we choose to enable that feature in
Windows. Then we have our Program Files folder. That's where we're going to see our 64-bit
applications, if this is a 64-bit system.

We have the Program Files x86 directory. That's going to be our 32-bit applications so that we have
backwards compatibility. We have program data that stores the application data in several subdirectories
there.

We have our Users directory, and that's going to have the user data in dedicated folders. Now, when I say
dedicated folders, what I mean is dedicated folders per user. So under the Users directory, we'll have
another directory that will be the username of an individual user.
We're also going to have a public folder. And that public folder that is within the user directory is going to
be shared between all users. Here we see that individual user folder, and then underneath that folder,
we're going to see app data.

Now app data is where we're going to store data that is specific to a user account. So let's say we have an
application, that application has something that has to do with a specific user. Well, it's going to put it in
this directory here rather than in Program Data.

We have the Windows directory. That's going to store all the operating system files. And then sort of
nested underneath that we've got the System folder. That's all the 16-bit DLL files. We have the
System32 folder, which is our 64-bit DLL files. We have the SysWOW64 folder. That's going to be the 32-
bit DLL files. And then we have the WinSxS. And that's going to be copies of the system DLLs. So basically,
we would move copies into there at runtime so that we can make use of them. But again, that's kind of a
working directory there.

But this is just an example of the Windows file system structure. And so we want to understand that
within a file system, what we just looked at was the C drive or the C directory-- C:\ -- and then we have
folders and files underneath that.

Well, whenever we have the location of an object, whether it be a file, maybe it's a MP3, a folder, or
whatever the case may be. Whenever we have that object identified by its location and we include the
drive letter and then that hierarchy of all the directories underneath it, we call that a file system path.

Now this is an example. C:\Users\employee\Downloads\[Link]. Now, this file system path is what
we call a fully qualified path. It's the entire path from the root directory C:\ all the way through the
Employee folder, Downloads, and then the actual file [Link]. Now, if we're in a directory-- in this
case we're in C:\Users\employee -- and we were to copy a file-- in this case, we're copying from the
Downloads folder [Link] to the Documents folder [Link]-- what you'll notice is I didn't include
the fully qualified path here. And that's because the Downloads folder and the Documents folder exist in
the employee directory.

This is what's known to be the relative path. The path that we specify here is relative to the directory
that we're already in. So for example, we have a base filename, sample. And then we have a file
extension, .txt. So this is the file that we're moving around or that we're copying in this case, or whatever
file we're working with.

But there's two parts to all of the files that are in a Windows operating system. That base file name and
then the file extension. Well, there are several extensions-- .exe, .pdf, .xls, .png, .slsx, and more. These
are just a sample of some of the file extensions that we might see. In Windows, this file extension helps
identify which application should be used to open the file.

All right, over here in Windows, let's open up our File Explorer. And let's just go to the C:\ directory. And
here we can see those subfolders. And here we've got Users. So we're going to click on that. And under
Users, we have our Employee user.

And here is a listing of the directory. We can see that we have our desktop and our documents and our
downloads. Here's a sample text file. If we right click on this text file, we can open up the properties for
this file. And under the properties of the file, we can change the application that it opens with. We could
change the name of the file-- we could call this sample2, for example-- we see some information on the
location, the size, when it was created, modified, and accessed.

We can see some attributes, whether it's a read-only or a hidden file. And if we click on the Advanced
button here, we have some options as far as file attributes go. The file is ready for archiving. And we are
allowing it to be indexed.

We can click on the Security tab, and we see the group or usernames that are able to interact with this
file. And when we select between these groups or usernames, down below, the permissions will switch
to either that user or group. So for example, right now we're on Administrators. And here are the
permissions for Administrators.

And we can see what they're allowed or denied-- full control, modify, or read and execute, read/write,
special permissions, and so on. Now, when we access our file properties through the GUI, we have the
ability to modify some of the attributes of the file, but not all of them.

If we were to open up our command line, we have actually more capability. We can use the attrib
command. And we'll just do a /?. And this shows us the different options that we have for displaying or
changing our file attributes.

So what we can do as an example is we can modify the archive file attribute. So if we use the attrib
command, and we do a +a. And we'll do this on [Link]. If we go look at that file now-- we'll go into
this PC. Our C drive, Users, Employee, and then if we right-click and go to our Properties, and we click on
Advanced, we can see that the file is ready for archiving.

So we'll close that out. We'll leave that window open where it's at. Use our up arrow. And we'll take that
attribute away. And now let's go look at it again. And we go to Advanced, and there we go. That
checkbox is now gone. And that's because we have modified the attributes of the file, and we've done it
through the command line.

In a Windows-based system, every storage device that is connected to a host contains its own file
system. The Windows operating system can be installed on virtually any drive that is connected to the
host. However, it is most often installed on the first physical hard drive that is connected to the host.
Hard drives, or any storage media for that matter, are identified with letters.

The first hard drive is given the letter C, followed by a colon (:). The Windows file system is not case-
sensitive by default (although Windows can be configured to support case-sensitivity). Therefore,
accessing the C: and c: drives will reference the same device. Additional storage media is given the next
sequential letter designation.

The hard drive on which the Windows operating system is installed is typically organized in the following
manner:
The following lists the major directories of of the Windows file system:

 Boot: A hidden directory that contains system boot files.

 Logs: As of Windows 10, the directory where event logs are stored.

 PerfLogs: Stores performance logs if this feature is enabled in the operating system.

 Program files: In 64-bit Windows installations, stores 64-bit applications.

 Program files (x86): In 64-bit Windows installations, stores 32-bit applications.

 ProgramData: Directory used to store application-need data. Applications are not able to write
directly to this directory, but they can create subdirectories used for their own purposes.

 Users: Directory where users store their data. Each user with an account on the system has a
folder that is dedicated to them. Users with standard account privileges are only able to access
the data in their assigned directory.

1. Public: This subdirectory of the Users directory can be shared among all the users of a
system. Normally, Windows access controls do not allow users to access data in other
users’ directories. However, the public directory allows anyone on the system to store
data, making it ideal for sharing data among users.

2. <username>: All users with accounts on a Windows host are given areas for their use.
The area for each user resides under the Users directory and bears the name of an
individual user’s account. This area allows users to privately store their documents and
other data since other users are permitted access to their own directory only. Each
user’s directory includes a subdirectory that is called AppData. This location is used by
applications that need to store things specific to a user, for example a user’s browsing
history.

 Windows: The directory that stores the operating system and its various subsystems.

1. System: This directory is used to store 16-bit system dynamic link library (DLL) files. In
64-bit Windows installations, this directory is normally empty.
 2. System32: This directory is used to store 64-bit system DLL files in 64-bit Windows
installations.

3. SysWOW64: 64-bit Windows is backward compatible with 32-bit applications. This

directory stores 32-bit system DLL files.

4. WinSxS: This directory stores copies of system DLL files. Often, these files represent
older versions of the DLL files that may be required by older applications. The folder
name stands for Windows side by side because it allows older applications to co-exist
with newer ones that require the most current DLL files.

File System Paths

The Windows file system is hierarchical. The root of a disk drive represents the top of hierarchy with
multiple levels of directories that can store files or other directories. The term “path” refers to the
location of an object, such as a file, which includes the drive and hierarchy of directories that uniquely
identify the location of the object. For example, if you use your browser to download a PDF document,
the system will store the document in the downloads directory of your user directory, which resides on
the disk drive on which the operating system is installed—usually the C: drive.

C:\Users\Ed\Downloads\[Link]

Each element of the path is separated by a backslash (\) character. Note that the path starts with a
reference to the disk drive, followed by the series of directories that you must traverse to get to the file,
and lastly, the filename. Known as a “fully qualified” path, it includes all the information that is needed
to identify the specific location of the file.

Windows also supports relative paths to identify the location of an object. For example, when you open
the command-line window, the system puts you in your user directory. The command prompt itself
specifies the directory that you are in. To locate the PDF file that you downloaded with your browser, you
only need to specify the location of the file relative to your current location. In the example that follows,
the user wishes to copy the PDF file from the downloads directory to the documents directory:

C:\Users\Ed> copy Downloads\[Link] Documents\[Link]

Note that with the relative notation, the leading backslash is omitted since that would represent the root
of the drive. Because the user was already in their user directory, and both the downloads and
documents directories reside in the user directory, only those directories that need to be referenced in
the command, along with the file to be copied.

File Naming Conventions

Filenames in the Windows file system consist of two components:

 Base filename

 File extension

The maximum number of characters that can be used to express a file path is 256 characters. Four
additional characters are included in fully qualified names (bringing the total maximum number of
characters that is supported to 260), which includes the drive letter, the colon that follows it, the
backslash that represents the root of the drive and a null character at the end of the filename to
terminate the filename.

However, it should be noted that Microsoft allows you to increase the MAX-PATH length within Windows
10.

The Unicode version of Windows file I/O functions allows for longer paths: approximately 32,767
characters. By using the extended paths, files and directories can be hidden and some tools are not able
to find them. The Windows cmd shell only supports ANSI file paths. Any tool that uses ANSI file I/O
functions or fails to support \\?\C:\ paths cannot access the directories and files that exist after the first
260 path characters.

In a Windows filename, a period or dot character (.) is used to separate the base filename from the
extension. However, most other punctuation characters cannot be used in a filename because they have
special meanings to the Windows command interpreter.

In Windows, the file extension is used to identify an association between a file and the application that is
needed to open or execute the file. The list below contains examples of common file extensions and the
applications with which they are typically associated:

 .exe: Executable file

 .txt: Text file

 .rtf: Rich text file

 .pdf: Portable Document Format

 .bmp: Bitmap graphic image

The list is just a small sample of file extensions. You will mostly see them expressed with three characters
but that is not a requirement. File extensions are mapped in the operating system to specific
applications. Often, a file format that is used by an application is assigned a unique icon by the
application when the application is installed. It registers the extension association so that when a user
double-clicks the icon that represents the file, the operating system will know which application to
launch. Users can change these mappings but it is not done frequently.

File Properties, Attributes, and Permissions

File properties are essentially details about a file, including the file’s modification and creation date, file
size, and other meta information about the file. Specific information that is stored as a property of a file
can differ by file type. For example, an audio file will allow you to add a rating, but that same attribute is
not supported for text files. Some properties can be modified depending upon the type of file and its
ownership permissions.

Another aspect of a file’s properties is file ownership, which allows Windows to enforce a degree of
access control so that only the user that creates a file and the administrator initially have permission to
access the file. File owners and administrators can grant permission to others. Note that to implement
Windows file permissions, you must be using the NTFS file system.
To view or modify the ownership and permission properties of a file, right-click the file, choose
Properties, and then select the Security tab.

Currently, the administrator account (represented by the single person icon) and the members of the
administrators group (represented by the two-person icon) can access the file. The system user that is
listed is a special account that is used by the operating system. By default, the system user is granted full
control to every file. You can add users to the list to give others access to the file by clicking the Edit
button under the Group or user names box.

In the figure below, the user has added the Users group to the file properties.
Once you have decided which users should have access to the file, you can specify the permissions to
grant each user or user group. The permissions are defined below:

 Read: Allows users to view and list files and subdirectories.

 Write: Allows users to write to files or add files and subdirectories to folders.

 Read and execute: Allows users to view the contents of files, list files and subdirectories, and
execute files if they are of an executable type. The read and execute permission does not grant
permission to write to the file.

 Modify: Permits users to read and write to files and subdirectories and grants permission to
delete files and directories.

 Full control: Permits reading, writing, modifying, and deleting files and subdirectories.

You have the ability to explicitly allow or deny file/directory permissions by checking the boxes in the
appropriate column. If a specific permission level is not set, the deny permission will take precedence.

[ ] Allow [ ] Deny = Deny

[X] Allow [ ] Allow = Allow

[ ] Allow [X] Deny = Deny

[X] Allow [X] Deny = Deny

Another aspect of Windows file properties is file attributes, which are metadata associated with every
file. File attributes are used to define how the system, applications, or users can interact with a file. You
can view many of the attributes that are associated with a file by right-clicking the file and selecting
Properties from the context menu.

Note the attributes section that is near the bottom of the window. Click the Advanced button to expose
more attributes.
The following is a complete list of available file attributes:

 Archive: Used to mark files for backup

 Compressed: Indicates that the data in a file is compressed

 Device: Reserved for system use

 Directory: Marks the object as a directory rather than a file

 Encrypted: Indicates that the file or directory is encrypted

 Hidden: Hides the file or directory from standard directory listings

 Normal: Identifies files that have no other attributes set. It is only valid when used alone

 Not Indexed: The file or directory is not indexed by the content indexing service.

 Offline: File data is not available because it has been physically moved to offline storage; used by
remote storage applications.

 Read-only: Applications can read the file data but cannot write or delete it.

 Reparse Point: A file that is a symbolic link

  System: A directory that is reserved for use by the operating system

 Temporary: Indicates that the file is used for temporary storage. Typically, the application using
the file deletes it when the file handle is closed.

 Virtual: Reserved for system use.

There are several ways to set or view file attributes. For example, from the file properties box, you can
view or modify several, but not all, file attributes. You can also view and modify file attributes from the
command line with the attrib command. The help text from the following command-line example shows
the various options that you can use with the attrib command:

C:\Users\[Link]\Downloads>attrib /?

Displays or changes file attributes.

ATTRIB [+R | -R] [+A | -A ] [+S | -S] [+H | -H] [+I | -I]

[drive:][path][filename] [/S [/D] [/L]]

+ Sets an attribute.

- Clears an attribute.

R Read-only file attribute.

A Archive file attribute.

S System file attribute.

H Hidden file attribute.

I Not content indexed file attribute.

[drive:][path][filename]

Specifies a file or files for attrib to process.

/S Processes matching files in the current folder

and all subfolders.

/D Processes folders as well.

/L Work on the attributes of the Symbolic Link versus

the target of the Symbolic Link

Not all the attributes are available for viewing or change with this command because some attributes are
only modified by applications or the system. In the example that follows, the attrib command is used to
set the read-only attribute on a file:

attrib +R [Link]

Content Review Question

Correct

Which Windows directory stores the 64-bit applications?

Program Files (x86)

 Program Files

 System

 System64

Answer

The correct answer is Program Files.

Content Review Question

Correct

Which Windows file attribute is used so that the file will not be listed from the standard directory
listings?

read-only

 hidden

 special permissions

 not indexed

Answer

The correct answer is hidden.

Windows Domains and Local User Accounts

In a Windows domain, we have what's known as a domain controller. And this is the central
configuration point control for all of the computers that are part of this domain. Now, the domain has a
name. In this case it's [Link]. And most often, we'll be running Active Directory as our domain
controller. We could use Active Directory, which essentially is LDAP, or we could install a specific LDAP
server to control the domain. But really what we're talking about here is Active Directory.

Now, we create user objects on that domain controller, and then those user objects can log in to those
computers that are a member of the domain. Now, we have local user accounts on each individual
machine. There are two by default. We have the administrator and we have a guest user account.

Now, modern versions of Windows are going to prompt during set up for you to create that
administrator account. They don't enable an account called Administrator any more. But they used to.
Now, the guest account is not enabled by default. You can probably guess that this is for security
purposes.

Now, if we wanted to add a user account, we can do that in multiple ways. Let's take a look at that. So we
are logged into a Windows machine as a local user. And so if we just go to our Start and then type in
user, we can go to our Control Panel and then User Accounts. And from here we can manage user
accounts, and we can see we're logged in as employee1 to the desktop here, and that we are an
administrator.

And we could click Add. And this will allow us to add a username. And it wants some domain
information. So that's one way to add user accounts is to do it through the Control Panel. We can close
that. If we go down to Start and we type Users, again, we can add, edit, or remove other users. And
we've got a nice Windows method of doing that here.

And so we'll close that. That's a second option. And then if we type Users again, we can add local users
and groups. Edit local users and groups here. And this is going to bring up the Local User Manager
interface.

And from here we can go to our users, and it lists those users that are here. We have Administrator,
employee1, and Guest. And if we were to go to Administrator here, this account is disabled. So as
mentioned before, Windows doesn't enable this account for us by default during the install. Instead, it
prompted us during the install, and we created Employee 1. And it is a member of the administrators
group.

So what we're going to do is just right-click here. We'll click on New User, and we can create sample1.
And we'll give it a password, and then we'll tell it that we don't want the user to change the password
the next time they log in. In fact, they cannot change their own password. The password never expires.

And then if we just click on Create, it automatically removes all the entries from this field so it can create
another user. If I just close that, now there's the sample1 user. And if I were to open that up and click
Member Of, they're just a member of Users. And if we wanted to, we could add them to the
Administrators group. And now they can administer this computer. We're not going to do that. We'll click
on Remove and just leave them in the Users group, and click OK. And, of course, that's how we would
create a local user on a Windows system.

Windows systems can act as stand-alone hosts, or they can be members of domains. Domains are groups
of Windows hosts that are managed by a centralized authority, which is known as a domain controller.
One administrative aspect of system management that is handled at the domain level is users and user
groups. Stand-alone systems are capable of hosting multiple user accounts; however, each account is
managed locally on the host.

Windows Domains

Windows domains represent a closed system of users and computers that can share resources and
adhere to one centrally controlled management structure. Each user and machine belonging to that
domain must authenticate with a domain controller to access the system. A domain controller is a server
that is running a version of the Windows Server operating system and has Active Directory domain
services installed.
A small organization might need only one domain with two domain controllers for high availability and
fault tolerance. A larger organization with many network locations will need one or more domain
controllers in each site to provide high availability and fault tolerance.

One of the greatest advantages of Windows domain setup is the ability to use group policy to control all
the settings of each workstation in granular detail. The Active Directory is based on the LDAP which is
designed to store information about virtually any type of object in a network that anyone may need to
locate. Objects can be users, hosts, devices, or virtually any type of resource. Objects are grouped in
structures that are known as containers. Containers can be nested with sub-containers to create a
hierarchy structure. Domains are the entities in which containers are stored, and an organization may
have one or more domains that can be organized by department or geographic location, for example.

Local Users and User Groups

A default Windows system ships with two default user accounts and several user groups. The default
user accounts are guest and administrator. Recent versions of Windows no longer enable the
administrator account because it runs with elevated privileges. At system initialization time, the system
prompts you to create a custom user account so that you can access the system without the
administrator account. The administrator account can be enabled at any time but the best practice is not
to do so. If an administrator account or an account with administrator privileges is compromised,
malicious code has greater access to critical system resources. Users that need to perform a task with
administrator-level access can select the Run as Administrator option when they select the object to act
on, such as a file or connected device.

The second default user account is called guest. This account is disabled by default and for most
installations it should remain this way. It is intended for situations where a Windows host may be
deployed in a public space or a location where it is likely to be accessed by many people that do not
necessarily have accounts on the host. It grants a limited amount of privilege and is not protected with a
password. Normally, customizations that a guest user makes during a session are erased when the guest
user exits. When a new guest accesses the host, they are presented with a default desktop environment
from which the user can launch authorized applications and access authorized system resources.

User groups determine the level of privilege that users have on the system. For example, placing a user
in the administrator’s group grants that user administrator privilege. Several user groups are present on
a standard Windows installation that grant specific rights to the users that belong to the group. For
example, a user can belong to the backup operator’s group, to perform backup and restore operations.
Most users will be assigned to the users group, allowing them to perform common tasks, run
applications, use resources such as network printers, or lock and shutdown the system.

Starting with the release of Windows 8, Windows products have been gaining greater integration with
Microsoft cloud services. To support these features, you could log in to a Windows system with a
Microsoft account (rather than a local account), which allows user data to be synchronized between
multiple desktop devices and mobile devices. For example, your files that are stored in the Microsoft
cloud drive are automatically available at login time. And your desktop profile migrates to whatever host
you log in to with your Microsoft account. A Microsoft account is available to any user that subscribes to
a public Microsoft service, such as Hotmail or its web-based applications. Users of these versions of
Windows can still create and use a local account on the host, but they lose cloud functionality unless
they sign in to these applications manually.

Creating a Local User Account

There are several ways to access the application to manage user accounts on a Windows system, but the
most common method is through the control panel. The exact method for accessing the control panel
depends on the version of Windows, but, usually you can get to it from the Start menu in the lower-left
portion of the screen. From there, you will either see an option to navigate to the control panel or, in
recent versions of Windows, you will see a Settings option that opens a tablet-friendly version of the
control panel. With the control panel or settings window open, you can navigate to the user accounts
selection, where you can create or manage local user accounts.

When you create an account, you are prompted for the username and domain. If you are creating a local
account, you can leave the domain field blank. Next, you are prompted to provide the level of access to
grant to the user. Choose standard user access, administrator access, or other, which lets you specify the
privilege level from a drop-down list of options.

After making your selections, click Finish to complete the process. When the user attempts to log in with
the new account, they are prompted to create a password for the account. Note that to create an
account, you must either be logged in as the administrator or be a member of the administrator group.

User accounts can also be created through the net user menu from the command shell.
Content Review Question

Correct

What is required for an attacker to create another local user account on a Windows host?

edit the Windows registry

 access to the Windows domain controller

 log in as the administrator or be a member of the administrator group

 root access

Answer

The correct answer is log in as the administrator or be a member of the administrator group.

Content Review Question

Correct

A group of Windows hosts can be managed by which central controller?

group policy controller

 domain controller

 LDAP controller

 windows event controller

Answer

The correct answer is domain controller.

Windows GUI

One of the things about the Windows Graphical User Interface is how it is designed to enable the user to
access features quickly. What we're looking at here is a Windows 10 desktop, and it's actually similar to a
Windows 7 desktop, except Cortana has been introduced down here on the bottom left. Well, if we want
to access an application, we can click on the little Windows icon, which used to be the Start button. So
when we click on that, we can then go ahead and type whatever it is that we want to open. For example,
if we want to open up Wireshark, we can start typing Wireshark, hit Enter, and we'll get the Wireshark
desktop app launched for us in our Windows GUI.

OK, so we'll close that Wireshark interface out there. Another thing that we can do is we can use the
right-click option on an icon here, and it opens up a contextual menu and from here we can choose to
open. That's an alternative to launching an application. We could double-click on it and it'll open. Of
course, this is just basic Windows navigation skills.
But the reason that we point this out is because of the fact that if we are going to be working in a SOC
and we're going to be analyzing computers, we need to be able to navigate them, work with applications
in their interface. For example, the Windows Explorer. If we click on the little Explorer icon down here, it
opens up the Windows File Explorer.

Now, File Explorer is part of the GUI interface. It gives us the ability to click on this little quick access
window here, this address bar. And we can type in specific locations.

So right now, I don't have permission to access that folder, so I'll just continue. And it shows me just an
empty folder again because I don't have permissions to access that folder. But again, it gives us the
ability to navigate through here.

Let's just go into this PC, and we'll click on the C drive. And then we'll click on Users and employee1. And
from here, I'm going to right-click. That gives me the contextual menu.

And I'm going to create a new text file. So we'll create a text document. And we're going to call this
sample and hit Enter. So we've just created that text document. We can right-click on that, and we can
edit that document. Opens up Notepad for us.

This is a test. And we'll go ahead and click our X. We'll save it, and file size has changed.

Again, we've got several contextual menus that will change based on what it is that we right-click on. So
for example, down here on the bottom right-hand corner of the screen, we have the little icon in the
systray that indicates that we have a network connection. If we right-click on that, we get an option to
open our Network and Sharing Center. From there, we can click through and we can work with our
Ethernet interface and so on.

But again, just being able to navigate the file system and use that right-click to access additional options
will be very important for a security analyst that's working in a SOC.

One distinguishing feature of the Windows operating system is that it is operated primarily from the
graphical interface. It has a command line from which you can execute commands and navigate the file
system, but usually a Windows-based host is operated from the graphical interface. The following figure
shows a typical Windows 7 desktop.
The main panel of the screen is known as the desktop. Each user is given a desktop, which is an
environment that the user can customize in various ways, such as using an image for the desktop
background or changing the color scheme. The desktop can also be used to store files, folders, or
application icons. The recycle bin icon in the upper-left portion of the desktop is reserved for deleted
files. Rather than making files unavailable immediately after deleting them, Windows stores deleted files
in the recycle bin. Files are not fully deleted until you empty the recycle bin.

The lower portion of the screen contains the task bar which is further divided into three primary areas:

 Start menu: The icon that is at the far left portion of the task bar is the Start menu. The start
menu gives you access to all your applications and other special features of the system such as
the control panel. It also contains a field that you can type in to search for items or run
commands.

 Quick launch icons: The middle portion of the task bar contains a series of quick launch icons,
which act as launch buttons for applications that you place in the task bar. It also creates an icon
for each application that is currently running. Clicking the icon of a running application brings it
to the foreground so you can use it. You can also pin application icons to the task bar for easy
access to frequently used applications.

 Notification area: This area contains several features for viewing notifications and controlling
applications or processes that run in the background. The arrow icon opens the system tray
which is where you can access options for controlling background applications. The flag icon lets
you view system notifications and the icon to its right lets you view and control networking
status. The shape of this icon will change depending upon how you are connected to the
network. If you are wired to the network over an Ethernet connection, the icon will appear as a
computer terminal; if you are connected over a wireless adapter, you will see the wireless icon
here instead. This area also contains a clock so you can view the date and time. Lastly, there is a
rectangular button in the far right portion of the task bar that is used to minimize all the running
applications and show you the desktop.

Windows Context Menu

Another feature of the Windows desktop is the ability to bring up a context menu in virtually any part of
the graphical interface. Right-click an item to open a context menu. Windows keyboards also contain a
context Menu key that exposes a context menu at the location of the mouse pointer. The context menu
presents menu options that are relevant to where you opened it. Also, some third-party applications add
items to the context menu. For example, right-clicking a file produces the following context menu:
Windows File Explorer

Windows provides a tool for managing files and navigating the file system, which is known as the
Windows File Explorer and is sometimes referred to as Windows Explorer. It is a utility that runs in the
graphical environment and can apply many of the features of the graphical environment, such as drag-
and-drop and the context menu.

Note

Windows File Explorer, previously known as Windows Explorer, is a file manager application that is
included with releases of the Microsoft Windows operating system from Windows 95 onwards.
The navigation panel along the left side of the window provides shortcuts to various locations that you
may frequently visit both in the local file system and network locations. A triangular icon in this panel
indicates that these areas may be expanded to show more subsections that reside hierarchically. Click a
selection in the left panel to populate the main panel a detailed view of the selection. In the example,
the user selected computer, which displays the drives that are connected to the computer and basic
information about each of them, such as how utilized the drive is. Double-click one of these icons to drill
further down into the file system.

When you arrive at a file system location that interests you, right-click an item in that location to get the
context menu. The context menu provides several file management options (for example, cut and copy)
or other management options (for example, to view the file’s properties.

The Windows operating system is known for its rich graphical interface which makes for an intuitive and
easy-to-use end-user platform. Though it does provide a CLI which is also quite robust, most users
choose to operate the system using the graphical interface.

Content Review Question

Correct

Referring to the screenshot below, which area of the Windows GUI is accessed to initiate the McAfee
scan?
Start Menu

 Quick Launch icons

 Notification area

 Windows File Explorer

Answer

The correct answer is Notification area.

Content Review Question

Correct

Which component of the Windows operating system GUI task bar is used for navigating the file system?

Windows Context Menu

 Windows Internet Explorer

 Windows File Explorer

 Windows PowerShell

Answer

The correct answer is Windows File Explorer.

Run as Administrator

There are certain situations where you want to run an activity or an application as an administrator. So
let me give you an example.

If I click on my Start option and I type in [Link], I'm opening up my Microsoft Common Console
Certificate Manager. So this is going to allow me to go in and modify my certificate. I'm kind of limited in
what I'm able to do here.

However, if I were to come in here and type in [Link] and then I right-click on the application, I can
run this as an administrator. I'll be forced to log in, and now I'm going to be running this application as an
administrator. However, I now have the ability to access more than what I had access to before.

The same is true for my command console. If I were to come down here and click on my command
prompt, you can see I am accessing the employee's command prompt, C:/Users/employees, but I don't
have administrative access. Let's close this and run it as an administrator.

So we want to right-click here, right-click on Command Prompt, and I can run as administrator. Again, I'll
be forced to log in, but once I have, you'll now see that I'm in the system32 folder. And I actually have
administrative rights to go in and make changes.

So having that ability to right-click and run as administrator is definitely something you're going to want
to be able to do. It's a common task when we are managing a Windows operating system.

Certain tasks that you need to perform to administer a Windows system may require administrator
privileges. Normally, the command interpreter runs with the permissions that are configured for the user
who is operating the command line. However, you can elevate your permissions to administrator level
using the following methods:

 Right-click a command icon: If there is a command you need to run as administrator, you can
use the Windows File Explorer to find the command and right-click it to bring up its context
menu. From there, you can Run as administrator, as seen in the figure. This technique can be
useful in situations where you need to install an application with the administrator context. In
the figure, the user is installing an AMP for endpoints connector which requires administrator
privilege.
 Open the command interpreter as administrator: Right-click the icon for the command line to see
that the same option, Run as administrator, is also available. The difference is that all the commands
that you execute from the command line will run with the administrator context.

 Windows Key-X brings up a special context menu that contains a menu item, hotkey A, which opens
an administrative command shell. The shell can be configured to Powershell from the Windows Registry.
Content Review Question

Correct

When you are logged in as a standard user, how do you run an application with administrator privilege?

Left-click the application.

 Double left-click the application.

 Right-click the application, then select the Run as administrator option.

 Launch the command line, enter the su root command, then left-click the application.

Answer

The correct answer is Right-click the application, then select the 'Run as administrator' option.
Content Review Question

Correct

How can an attacker who is using the Windows command line run all the commands with administrator
privilege?

Run the command prompt program as administrator.

 Use the su root command.

 Boot Windows in Safe mode.

 Use the –admin option in the command-line commands.

Answer

The correct answer is Run the command prompt program as administrator.