Wiki
This wiki shows where Windows and Active Directory leave evidence, what that evidence proves and how to find it. It is written for defenders and investigators, and it starts from the basics.
/
Read in This Order
New to this? Read these pages one after another. Each one builds on the one before it.
- 1The Basics of a Process What a process, a PID, a DLL, a handle and a token are. Windows Processes
- 2Windows Registry Where Windows records what people and programs did. Windows Registry
- 3How Active Directory Sign-In Works How Kerberos and NTLM sign a user in, and what each step logs. AD Sign-In
- 4Kerberoasting A first attack on that sign-in, and the evidence it leaves. AD Attacks
- 5How Tech Stacks Fit Together The layers under a service, and how far a flaw in one reaches. Tech Stacks
Browse by Topic
These are the topics in the sidebar, in the same five groups. A greyed topic is still being written.
Foundations
The layers every system runs on.
Forensics
What Windows records, and what it proves.
- Windows Processes What a process is made of, what normal looks like and the signs it is not. 49 pages
- Windows Registry Where Windows records what happened, and the query that finds it. 105 keys
- Event IDs The Windows events behind logons, lateral movement and new services. Soon
- Timestamps What changes a file time, and how to tell when one was faked. Soon
- USB Device Profiling Which device was plugged in, when, by whom, and what it held. Soon
Detection
Searches to paste into your own tools.
- Splunk Recommendations The settings and searches we recommend on every Splunk build. Soon
- KQL Starter Hunts Defender XDR and Sentinel hunts for the attacks we see most. Soon
- EDR, XDR and Antivirus Compared Endpoint protection tools side by side, against the same attacks. Soon
Offensive
How the attacks work, and what they leave behind.
- AD Attacks What each attack abuses, what it needs first and what defenders see. 31 attacks
- Privilege Escalation Linux and Windows routes to admin, each variation in turn. Soon
- HTTP Status Codes What each code tells a tester, and the ones worth a second look. Soon
- Web App Testing The checks we run on every web app, from sign in to business logic. Soon
Research
How well-known flaws work, and what to do.