Windows Fundamentals

Question 1

What is the file system used in modern versions of Windows?

Answer 1

NTFS, New Technology File System

Question 2

Alternate Data Streams

Answer 2

File attribute specific to NTFS. Allows files to have more than one stream of data.
For example when you download a file from the internet there are identifiers written to ADS to identify it as a download.
Bad actors sometimes use ADS to hide data

Question 3

In Windows, what folder holds the important files that are critical for the operating system?

Answer 3

System32

Question 4

Where are user profiles kept in Windows?

Answer 4

C:\Users
Example- C:\Users\Dylan

Question 5

What Windows feature prevents operations requiring higher-level privileges from executing without confirmation from the local admin?

Answer 5

UAC, User Account Control

Question 6

System process- what is it, what is its file name?

Answer 6

System is responsible for the system memory and compressed memory in the NT kernel.
File name is ntoskrnl.exe

Question 7

smss.exe

Answer 7

Windows Session Manager, responsible for creating new sessions

Question 8

What should be the parent process for smss.exe?

Answer 8

System

Question 9

What does smss.exe start in Session 0?

Answer 9

An isolated Windows session for the operating system, with two processes:
csrss.exe
wininit.exe

Question 10

What does smss.exe start in Session 1?

Answer 10

The user session, with two processes:
csrss.exe
winlogon.exe

Question 11

csrss.exe

Answer 11

Client Server Runtime Process
The user-mode side of the Windows subsystem. This process is always running and is critical to system operation.

Question 12

What should csrss.exe show for a parent process?

Answer 12

It shouldn’t. csrss.exe is started by smss.exe which then self-terminates, so it will show as “non-existent process”

Question 13

wininit.exe

Answer 13

Another critical Windows process that runs in the background, along with its child processes.
Responsible for launching services.exe (Service Control Manager), lsass.exe (Local Security Authority), and lsaiso.exe within Session 0.

Question 14

What should wininit.exe show for a parent process?

Answer 14

It shouldn’t. wininit.exe is started by smss.exe which then self-terminates, so it will show as “non-existent process”

Question 15

services.exe

Answer 15

Service Control Manager (SCM)
Primary responsibility is to handle system services: loading services, interacting with services and starting or ending services.
It maintains a database that can be queried using a Windows built-in utility, sc.exe.

Question 16

What should services.exe show for a parent process?

Answer 16

wininit.exe

Question 17

How many instances of services.exe should be running on a Windows system?

Answer 17

1

Question 18

svchost.exe

Answer 18

Responsible for hosting and managing Windows services

Question 19

How many instances of svchost.exe should be running on a Windows system?

Answer 19

There can be many.
Since svchost.exe will always have multiple running processes on any Windows system, this process has been a target for malicious use. Adversaries create malware to masquerade as this process and try to hide amongst the legitimate svchost.exe processes.

Question 20

What parameter should svchost.exe always use to call upon

Answer 20

-k

Question 21

What should svchost.exe show for a parent process?

Answer 21

services.exe

Question 22

lsass.exe

Answer 22

Local Security Authority Subsystem Service
Responsible for enforcing the security policy on the system.
It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log.

Question 23

How many instances of lsass.exe should be running on a Windows system?

Answer 23

1

Question 24

What should lsass.exe show for a parent process?

Answer 24

wininit.exe

Question 25

winlogon.exe

Answer 25

Windows Logon
Responsible for handling the Secure Attention Sequence (SAS)- the CTRL+ALT+DEL combo
This process is also responsible for loading the user profile, locking the screen and running the user’s screensaver.

Question 26

What should winlogon.exe show for a parent process?

Answer 26

It shouldn’t. winlogon.exe is started by smss.exe which then self-terminates, so it will show as “non-existent process”

Question 27

explorer.exe

Answer 27

Windows Explorer
The process that manages the Desktop. This process gives the user access to their folders and files. It also provides functionality for other features, such as the Start Menu and Taskbar.

Question 28

What should explorer.exe show for a parent process?

Answer 28

It shouldn’t. explorer.exe is started by userinit.exe which then self-terminates, so it will show as “non-existent process”

Question 29

What would be particularly concerning behavior for explorer.exe?

Answer 29

Seeing outbound TCP/IP connections

Question 30

What are some things to look for with any of the core Windows processes to ensure they are legitimate?

Answer 30

The file path- typically C:\Windows\System32
The parent process- most should have a specific parent process or none listed at all
The number of instances- some should only have one
The spelling of process names- hackers may try to masquerade as a process and use a close but not accurately spelled name

Question 31

Sysinternals

Answer 31

A compilation of over 70+ Windows-based tools. Includes File and Disk Utilities, Networking Utilities, Process Utilities, Security Utilities, System Information, etc

Question 32

PsExec

Answer 32

Lightweight replacement for Telnet that allows remote process execution on another system.
This can be utilized by adversaries

Question 33

Get-WinEvent

Answer 33

One of three primary methods of accessing event logs on a Windows system. This one is a Powershell cmdlet.

Question 34

DLL

Answer 34

A DLL file, short for Dynamic Link Library, is a library that contains code and data that can be used by more than one program at the same time.
For example, in Windows operating systems, the Comdlg32 DLL performs common dialog box related functions. Each program can use the functionality that is contained in this DLL to implement an Open dialog box. It helps promote code reuse and efficient memory usage.

Question 35

Shadow Copies

Answer 35

Used to create manual and automatic backups of files and drives
Threat actors may target these to prevent restoration of encrypted files during a ransomware attack

Question 36

What is the difference between Program Files and Program Files (x86)?

Answer 36

Program Files- 64 bit Windows programs
Program Files (x86)- 32 bit Windows programs