Windows Architecture Overview Link to heading

Windows architecture defines the foundational structure of the operating system, encompassing how processes run, how memory is managed, how users authenticate, and how security is enforced. For SOC analysts, this architecture represents the primary battlefield where attacks occur and must be detected.

User Mode vs. Kernel Mode Link to heading

User Mode Link to heading

User mode runs applications such as Chrome, Microsoft Word, and other user processes, along with some system services. Processes operating in this mode face significant restrictions: they cannot directly access hardware and cannot modify the kernel. From a SOC perspective, user mode is where most malware initially executes—phishing emails lead to malicious Word documents, which then launch PowerShell, ultimately enabling malware execution.

Kernel Mode Link to heading

Kernel mode runs the Windows kernel, device drivers, and the memory manager. This mode has full system access and operates with complete authority over hardware and system resources. SOC analysts must understand that rootkits operate at this level, and a kernel mode compromise results in complete system compromise.

Windows Core Concepts Link to heading

Windows Kernel Link to heading

The kernel handles CPU scheduling, interrupts, and thread execution. While it is rarely directly attacked, if compromised, it enables stealthy malware that is extremely difficult to detect.

Execution Layer Components Link to heading

• Process Manager: Creates processes and manages their lifecycle. SOC analysts should monitor for abnormal process spawning patterns.
• Memory Manager: Allocates memory for processes. Fileless malware often resides here, making detection challenging.
• I/O Manager: Handles disk and network operations. Unusual file or network activity may indicate compromise.
• Security Reference Monitor (SRM): This is the core security engine that checks whether a user can access a specific object. SOC teams must watch for privilege escalation and unauthorized access attempts.
• Hardware Abstraction Layer (HAL): Creates the interface between the OS and hardware. Advanced rootkits sometimes target this layer.
• Device Drivers: These facilitate communication between the OS and hardware. Threats arise from vulnerable drivers that enable privilege escalation and abuse of signed drivers.

Windows Processes Link to heading

A Windows process is a running instance of a program or application. Each process has the following attributes:

• PID (Process ID): A unique numerical identifier assigned to each process
• Memory: Virtual memory allocated to the process
• Threads: Units of execution within a process (one process can have multiple threads)
• Handles: References to system resources such as files, registry keys, and network connections
• Security Context: Runs under a specific user account (e.g., SYSTEM, Administrator, or standard user)

Essential System Processes Link to heading

• smss.exe: The first user mode process created during system startup
• wininit.exe: The Windows initialization process that starts system services
• services.exe: Manages system services and their execution
• svchost.exe: A generic host process for Windows services
• lsass.exe: Handles authentication and credential storage. Attackers target this process using tools like Mimikatz to dump credentials. SOC analysts must watch for malware hiding within legitimate processes.

SOC Detection Example: If winword.exe spawns powershell.exe, which then spawns cmd.exe, this indicates a malicious macro execution (Word exploit). This anomalous parent-child relationship is a key red flag.

Process Lifecycle Link to heading

The process creation flow follows this sequence:

1. User or system triggers execution
2. Windows32 API is called
3. Kernel creates a process object
4. Memory is allocated
5. Threads are created
6. Process begins execution

Parent-Child Relationship: Every process is created by another process (e.g., Explorer.exe spawns Chrome.exe). SOC analysts should investigate abnormal parent-child chains, such as Winword.exe spawning PowerShell.exe.

Process Types Link to heading

• User Processes: Applications run by users
• System Processes: OS-level processes
• Background Processes: Services running in the background

Process-Based Attacks Link to heading

• Process Injection: Malware injects malicious code into another legitimate process, such as explorer.exe. SOC indicators include suspicious child processes and memory anomalies.
• DLL Injection: A technique where a malicious DLL is injected into a legitimate process.
• Process Hollowing: A legitimate process like notepad.exe is started, then its memory is replaced with malicious code, effectively disguising malware as a trusted application.
• Living Off the Land (LOLBins): Attackers use legitimate system tools like PowerShell and rundll32.exe to carry out malicious activities. A key indicator is PowerShell executing with encoded commands.

Process Investigation Flow for SOC Analysts Link to heading

When investigating suspicious processes, follow this systematic approach:

1. Identify the process in question
2. Check the parent process to verify legitimacy
3. Review command-line arguments for anomalies
4. Examine the user context under which the process is running
5. Check for network activity associated with the process
6. Correlate with other logs for a complete picture

Common Red Flags to Watch For Link to heading

• Word spawning PowerShell (macro execution)
• Browser launching cmd.exe (drive-by download)
• svchost.exe spawning child processes (unusual behavior)
• Random executables running from Temp folders (indicates malware)

Windows Memory Architecture Link to heading

Virtual memory provides each process with isolated, protected memory space. However, this architecture is vulnerable to several SOC-critical threats:

• Process injection attacks
• DLL injection techniques
• Fileless malware that resides entirely in memory without writing to disk

Windows Registry Link to heading

The Windows Registry is a central hierarchical database storing system configuration, user settings, and application data. Analysts can view and edit the registry using the Regedit tool.

Registry Operation Link to heading

When the system boots, Windows reads the registry to load configuration, start services, and apply user settings. When applications run, they read registry values for their configuration needs. The registry stores different value types:

• REG_SZ: String values
• REG_DWORD: Numeric values
• REG_BINARY: Binary data

Registry-Based Attacks Link to heading

Persistence Mechanisms Link to heading

• Run Key: Located at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, this key executes programs at every user login. Attackers add malicious executables here to maintain persistence.
• RunOnce Key: Executes once and is then removed, sometimes used by malware for single-execution persistence.
• Services Registry: Located at HKLM\SYSTEM\CurrentControlSet\Services, this is where malware can install itself as a system service.

Other Attack Techniques Link to heading

• WMI Persistence: Advanced persistence using Windows Management Instrumentation
• Registry Hijacking: Replacing legitimate registry entries with malicious ones

SOC Detection Focus Link to heading

• Monitor for suspicious registry entries
• Watch for PowerShell.exe appearing in Run keys
• Detect unknown executables in auto-start locations
• Flag unusual paths like AppData\Temp

Registry Attack Flow Example Link to heading

Phishing → Word → PowerShell → Payload Execution → Registry Run Key Modified → Persistence Achieved → LSASS Attacked → Lateral Movement

Real SOC Example: Event ID 4657 indicates a registry key modification. If this event shows HKCU...\Run with a value of malware.exe, this indicates successful persistence establishment. Immediate investigation is warranted.

Windows Event Logs Link to heading

Windows event logs provide a forensic timeline of everything that happens within a Windows system. Logs are stored at C:\Windows\System32\winevt\Logs in .evtx format and can be viewed through Event Viewer. Every action generates telemetry—user logins, process starts, service activities, and policy changes all create events. For SOC analysts, these logs answer the critical questions: who, when, what, from where, and how. Without logs, effective investigation is impossible.

Windows Logging Architecture Link to heading

The logging flow follows this sequence:

1. An action occurs (login, process start, etc.)
2. An event provider generates the event
3. The Windows Event Log service collects it
4. The event is viewed in Event Viewer or forwarded to a SIEM

Key Components Link to heading

• Event Provider: Generates logs (e.g., Security provider, PowerShell provider)
• Event Log Service: Stores collected events
• Security Channel: Hosts the actual log entries

Log Types Link to heading

• Security Logs: Authentication, authorization, and privilege events
• System Logs: OS behavior, hardware, and driver events
• Application Logs: Application crashes and software activity

Security Logs Link to heading

Security logs are the primary source for SOC investigations, tracking authentication, authorization, privileges, and account changes.

Logon Types and Their Meanings Link to heading

By analyzing logon type combined with IP address and user account, analysts can identify attack patterns.

Critical Security Event IDs Link to heading

SOC Best Practices Link to heading

• Always check logon type in event 4624 for contextual understanding
• Correlate multiple events for accurate detection of complex attacks
• Investigate unusual logon times, locations, and privilege levels
• Enable advanced audit policy for comprehensive logging
• Regularly review and monitor critical event IDs

System Logs Link to heading

System logs track OS behavior, hardware events, drivers, and boot activity. Important event IDs include:

SOC Use Cases: System logs help detect system crashes that might indicate attack activity and identify malicious services being installed. Use system logs alongside security logs for complete visibility.

Application Logs Link to heading

Application logs track application crashes, software activity, and errors. From a SOC perspective, these logs help detect exploit attempts and identify malicious application behavior that could indicate compromise.

SOC Analyst Mindset Link to heading

When analyzing Windows systems, SOC analysts should consistently ask:

• Which process ran and why?
• What modifications were made?
• Is there any registry persistence?
• Was there any credential access?
• Is there evidence of lateral movement?

By maintaining this systematic investigative approach and understanding the Windows architecture and its logging capabilities, SOC analysts can effectively detect, investigate, and respond to security incidents.