Windows Architecture for SOC Analysts: A Complete Guide to Detection & Investigation - Part 11

Mon, 27 Jul 2026 10:00:10 +0530

Windows Architecture Overview Link to heading

Windows architecture defines the foundational structure of the operating system, encompassing how processes run, how memory is managed, how users authenticate, and how security is enforced. For SOC analysts, this architecture represents the primary battlefield where attacks occur and must be detected.

User Mode vs. Kernel Mode Link to heading

User Mode Link to heading

User mode runs applications such as Chrome, Microsoft Word, and other user processes, along with some system services. Processes operating in this mode face significant restrictions: they cannot directly access hardware and cannot modify the kernel. From a SOC perspective, user mode is where most malware initially executes—phishing emails lead to malicious Word documents, which then launch PowerShell, ultimately enabling malware execution.

Registry Persistence & Forensics on Mohd Kashif | SOC Analyst

Windows Architecture for SOC Analysts: A Complete Guide to Detection & Investigation - Part 11

Windows Architecture Overview Link to heading

User Mode vs. Kernel Mode Link to heading

User Mode Link to heading