Windows Architecture

Most enterprise environments run Windows. Understanding how it works inside - processes, services, and privilege boundaries - is essential for attacking and defending it.

This lesson covers the core architecture you will reason about during an engagement.

Windows splits execution into two rings:

• User mode - applications run here with limited access.
• Kernel mode - the OS core and drivers run with full hardware access.

Exploits that reach kernel mode (for example via a vulnerable driver) give total control.

A process is a running program with its own memory; a thread is a unit of execution inside it. Each process has a unique PID.

List processes from a command prompt or PowerShell.

Several processes always run; impostors here signal malware:

• System (PID 4) - kernel threads.
• smss.exe - session manager.
• csrss.exe - client/server runtime.
• lsass.exe - holds credentials, a prime attacker target.
• winlogon.exe, services.exe.

lsass.exe (Local Security Authority Subsystem) manages authentication and caches credential material in memory.

Tools like Mimikatz dump lsass to steal password hashes and Kerberos tickets - one of the most important attacks to understand.

A service is a background program managed by the Service Control Manager, often running with high privilege at boot.

Misconfigured services (weak permissions, unquoted paths) are classic privilege escalation routes.

Applications talk to the OS through the Windows API exposed by DLLs like kernel32.dll and ntdll.dll.

Malware and offensive tooling call these APIs directly (CreateProcess, VirtualAlloc, WriteProcessMemory) to inject code and evade detection.

Every process carries an access token describing its user, groups, and privileges. Windows checks the token for every secured action.

Attackers steal or impersonate tokens to act as higher-privileged users - the basis of many privilege escalation techniques.

Windows assigns integrity levels (Low, Medium, High, System). User Account Control (UAC) runs admins at Medium until they elevate.

UAC bypasses are a common step to jump from Medium to High integrity without a prompt.

Programs load shared code from DLLs. Windows searches specific directories in order to find them.

If a writable directory comes first, an attacker can plant a malicious DLL - this is DLL hijacking / search-order abuse.

Microsoft's Sysinternals suite is invaluable for both defenders and attackers:

• Process Explorer - deep process tree and handles.
• Process Monitor - live file/registry/process events.
• Autoruns - every auto-start location (great for finding persistence).

Recall the credential-holding process.

You mapped Windows architecture:

• User vs kernel mode; reaching kernel means full control.
• Key processes, especially lsass.exe for credentials.
• Services, access tokens, integrity levels and UAC.
• DLL search order abuse and Sysinternals for inspection.

Next: the Windows Registry.