Host-based Analysis and Network Intrusion Analysis Flashcards
What is a process made up of?
A process is made up of one or more threads
What is a thread?
the basic units an operating system allocates process time to
What is a Job Object?
Processes grouped together and managed as a unit
A thread pool ?
a group of worker threads that efficiently
execute asynchronous callbacks for the application
What is a Fiber?
is unit of execution that is manually scheduled by an application
What is CreateProcessWithTokenW function?
Using tokens to specify the current security context for a process by Windows.
Static memory allocation?
is when a program allocates memory at compile time
Dynamic memory allocation?
is when a program allocates memory at runtime
A heap
is memory set aside for dynamic allocation.
A stack ?
is the memory set aside as spare space for a thread of execution
A virtual address space?
is the virtual memory used by processes.
A virtual address ?
is a reference to the physical location of an object in memory
HKEY_CLASSES_ROOT (HKCR): ?
HKCR information ensures that the correct program
opens when it is executed in Windows Explorer. HKCR also contains further details on
drag-and-drop rules, shortcuts, and information on the user interface. The reference location is HKLM\Software\Classes.
HKEY_CURRENT_CONFIG (HCU): ?
HCU stores information about the system’s current
configuration. The reference for HCU is HKLM\Config\profile.
HKEY_LOCAL_MACHINE (HKLM): ?
HKLM contains machine hardware-specific information that the operating system runs on. This includes a list of drives mounted on the
system and generic configurations of installed hardware and applications. HKLM is a hive
that isn’t referenced from within another hive.