An introduction to the Windows Internals series, covering the goals, prerequisites, and roadmap for understanding how Windows works under the hood from a security perspective.
Windows Internals
Deep dive into Windows architecture, processes, threads, memory management, and kernel internals.
8 articles·99 min total reading time
Module 1: Foundations
Core concepts of Windows architecture, OS design, processes, and threads.
Most people who run Mimikatz don't know what they're actually targeting. It's not a file. It's not a password database. It's a process — and understanding exactly what that means is what separates tool runners from actual red teamers.
Module 2: Windows APIs & Architecture
Tracing API execution from Win32 through Native API (ntdll) down to SYSCALL.
This post explains how Windows API calls actually reach the kernel — and why attackers bypass certain layers to evade detection.
Module 3: Windows Security & Kernel Mechanisms
LSASS credential architecture, SSPs, PPL, Credential Guard, and BYOVD driver attacks.
After getting SYSTEM, one process stands between you and every credential on the machine. Here's what lives inside it - and what modern Windows does to stop you.
EDRs operate from the kernel. To kill them, you need kernel access. Here is how attackers use legitimate, signed drivers to tear down defenses from the inside.
Module 4: Process Execution & Injection
Offensive primitives, memory invariants, Process Hollowing, and DLL Hijacking.
A step-by-step breakdown of how malware creates a legitimate process in a suspended state, hollows out its memory, and injects a malicious payload.
How to find and exploit DLL search order hijacking, Phantom DLLs, and DLL side-loading using Process Monitor.