Module 3: OS Internals for Defenders
Know what normal looks like — so you can spot what isn't.
7 lessons · 7 labs
You'll inspect what changed on WS-HR-01 — processes, persistence, credential access — still from the telemetry, not from a named op.
Path
- Lesson01
Lesson 3.1 — Windows Process Architecture
Process tree hierarchy, critical system processes, spotting suspicious parent-child relationships
- Lab02Intermediate
Lab 3.1 — Windows Process Baseline
Use Wazuh with Sysmon process telemetry to build a baseline of legitimate Windows processes, hunt broken parent-child relationships, uncover a dropped C2 implant masquerading as svchost.exe, then measure a real process-ancestry baseline in the archives and find the remote execution no rule matched.
- Lesson03
Windows File System & Registry
NTFS fundamentals, MFT, timestamps, registry hive structure, key locations attackers target
- Lab04Intermediate
Lab 3.2 — File System & Registry Evidence
Read the file-system and registry evidence Lesson 3.2 teaches, in Wazuh: registry hives and value types (Sysmon 12/13), a Mark-of-the-Web alternate data stream (Sysmon 15), a payload drop (Sysmon 11), Windows FIM on the Tasks and Prefetch folders, and a baseline hunt of the file server's object-access audit trail (4663) — then parsed MFT, Prefetch, Amcache and ShimCache excerpts from another engagement.
- Lesson05
Lesson 3.3 — Windows Event Log Architecture
Event channels, providers, critical Event IDs, Sysmon event types, log gaps
- Lab06Advanced
Lab 3.3 — Event Log Deep Dive
Analyze Windows Event Logs using the Wazuh Dashboard — hunt critical Event IDs (4624, 4625, 4688, 7045, 1102), correlate across log channels, measure the domain controller's channel coverage and record continuity, stack PowerShell script blocks and a thinly-ruled Sysmon channel in the archives to surface a named pipe nothing alerted on, and build an Investigation Matrix mapping events to the multi-stage attack.
- Lesson07
Lesson 3.4 — Windows Authentication & Credential Storage
NTLM vs Kerberos, SAM, LSASS, credential caching, how attackers steal credentials
- Lab08Advanced
Lab 3.4 — Credential Theft Detection
Hunt a credential-theft chain in Wazuh: LSASS memory access (Sysmon EID 8/7), a baseline of normal LSASS handle access in the archives whose long tail exposes an unalerted memory read, NTDS.dit extraction via ntdsutil on the domain controller, and Kerberoasting (Event ID 4769, RC4) with the KDC-issued TGT behind it. Map every technique to ATT&CK.
- Lesson09
Lesson 3.5 — Windows Services, Tasks & Persistence
Services architecture, scheduled tasks, common persistence locations, ATT&CK mapping
- Lab10Advanced
Lab 3.5 — Full Persistence Audit
Audit every persistence class on the hosts in scope for the Operation APT Breach investigation, across Windows and Linux — services (separating persistence from execution), registry Run keys across the environment, WMI subscriptions, scheduled tasks, cron, /etc/sudoers and systemd timers — and state your scope in a Persistence Audit Matrix.
- Lesson11
Linux Internals for Defenders
Process model, file system, authentication, logging, persistence mechanisms
- Lab12Intermediate
Lab 3.6 — Linux System Baseline
Baseline a compromised Linux endpoint with Velociraptor: processes, cron, systemd units, init scripts, shell profiles, SUID binaries and capabilities, SSH keys and sockets.
- Lesson13
macOS Internals for the SOC
launchd and Background Task Management, code signing, Gatekeeper, notarization, quarantine, XProtect, SIP, TCC, the unified log, and the Mac stealer chain
- Lab14Intermediate
Lab 3.7 — Triage a Mac Stealer
Browser-only: work through EDR and endpoint artefact excerpts from a compromised MacBook — launchd/BTM persistence, quarantine, code signing, TCC and the unified log — to reconstruct an Atomic-Stealer-style infostealer.