Copilotfree, in-browser
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Kernel mode, user mode, processes, threads, objects, and services: the structure every Windows attack and every Windows detection is written against.
Windows Architecture and Processes
Kernel mode, user mode, processes, threads, objects, and services: the structure every Windows attack and every Windows detection is written against.
The Windows Registry
One hierarchical database holds nearly every setting Windows has: how to read it, and why both attackers and defenders watch it.
Windows Permissions and Privileges
SIDs, tokens, security descriptors, and integrity levels are the four structures that decide what a process may touch, and how a weak account becomes SYSTEM.
PowerShell for Security
PowerShell pipes typed objects, not text, which makes it the sharpest way to read a Windows host and the reason attackers live inside it.
Windows Event Logs
The event log records who signed in, what ran, and which accounts appeared: the same trail an intruder wants gone and a defender watches in near real time.
Windows Networking and SMB
SMB on TCP 445 is how Windows shares files and how it proves identity over the network. It leaks shares, users, and sometimes a foothold.