#Windows Internals

Process Monitor (Procmon), a cornerstone utility from the Sysinternals suite, provides unparalleled real-time observation capabilities for file system, registry, process and thread, and network activities within the Microsoft Windows operating system. It represents an…

Thanh Trung LeMay 20, 202557 min read

This document provides a detailed exploration of Windows operations monitoring using Procmon, result interpretation, and a catalog of common result values. Navigate through the sections below to explore specific aspects: Process Monitor (Procmon) is an indispensable utility for…

Thanh Trung LeMar 18, 202537 min read

This document provides a comprehensive technical deep dive into Process Monitor (Procmon). Navigate through the sections below to explore its internal architecture, features, and advanced usage techniques: Process Monitor (Procmon) is an advanced monitoring tool for Windows…

Thanh Trung LeJan 21, 202545 min read

The Windows operating system employs a layered architecture where errors can originate at various levels, from hardware interactions to user-mode application logic. Understanding the propagation of these errors through different components is crucial for accurate diagnosis.…

Thanh Trung LeOct 15, 202422 min read

The Component Object Model (COM) and its distributed extension, Distributed COM (DCOM), are foundational technologies in the Windows ecosystem, enabling software components to interact seamlessly, regardless of the language they were written in or, in the case of DCOM, their…

Thanh Trung LeAug 27, 202460 min read

This document provides a comprehensive technical deep dive into Windows Service internals. Navigate through the sections below to explore specific aspects of service architecture, lifecycle, and diagnostics: This section defines fundamental components and concepts of the…

Thanh Trung LeJun 18, 202471 min read

This section provides essential identifiers and definitions serving as context for the subsequent configuration and event data artifacts. Understanding these concepts is crucial for effective security monitoring. Important Note: For Windows to generate security audit events,…

Thanh Trung LeDec 12, 202322 min read

Security Principals are entities in Windows that authentication systems recognize and assign permissions and rights to. Each principal has a unique Security Identifier (SID). The main types are: User Accounts: Represent people or service identities. Local User Accounts: Stored…

Thanh Trung LeOct 17, 202320 min read

Windows User Profiles: Composition, Architecture, and Mandatory Profile Internals

Thanh Trung LeAug 22, 202346 min read

Windows Internals: The Storage Stack

Thanh Trung LeJun 20, 20236 min read