An introduction to the Windows Internals series, covering the goals, prerequisites, and roadmap for understanding how Windows works under the hood.
Windows Internals
Deep dive into Windows architecture, processes, threads, memory management, and kernel internals.
7 articles·73 min total reading time
This post explains how Windows API calls actually reach the kernel — and why attackers bypass certain layers to evade detection.
Most people who run Mimikatz don't know what they're actually targeting. It's not a file. It's not a password database. It's a process — and understanding exactly what that means is what separates tool runners from actual red teamers.
After getting SYSTEM, one process stands between you and every credential on the machine. Here's what lives inside it - and what modern Windows does to stop you.
EDRs operate from the kernel. To kill them, you need kernel access. Here is how attackers use legitimate, signed drivers to tear down defenses from the inside.
A step-by-step breakdown of how malware creates a legitimate process in a suspended state, hollows out its memory, and injects a malicious payload.
How to find and exploit DLL search order hijacking, Phantom DLLs, and DLL side-loading using Process Monitor.