Skip to main content

Study Guide - Final Assessment

Course Overview​

This course covers the fundamental aspects of Windows operating systems, with an offensive and defensive approach to cybersecurity.

Modules to Master​

Module 1-2: Fundamentals​

Key Concepts:

  • Hardware architecture (CPU, RAM, storage)
  • BIOS/UEFI and boot process
  • Secure Boot and TPM
  • Environment variables
  • Basic network configuration

Essential Commands:

# Network configuration
ipconfig /all
ping <address>
tracert <destination>

# Environment variables
Get-ChildItem Env:
$env:PATH
[Environment]::SetEnvironmentVariable("VAR", "value", "User")

Module 3-4: Configuration and File System​

Key Concepts:

  • NTFS: ACL, journaling, ADS
  • File and folder permissions
  • Shadow Copies and recovery
  • Windows Registry

Essential Commands:

# Permissions
Get-Acl file
icacls file /grant user:F

# ADS
Get-Item file -Stream *
Get-Content file -Stream streamName

# Registry
Get-ItemProperty "HKLM:\SOFTWARE\..."
Set-ItemProperty -Path "path" -Name "name" -Value "value"

Module 5-6: Network and Security​

Key Concepts:

  • OSI model and TCP/IP
  • Common ports and protocols
  • Windows Firewall
  • Windows Services

Important Ports:

PortService
80HTTP
443HTTPS
445SMB
3389RDP
5985WinRM

Essential Commands:

# Network connections
Get-NetTCPConnection -State Established
netstat -ano

# Firewall
Get-NetFirewallRule
New-NetFirewallRule -DisplayName "Name" -Direction Inbound -Action Block

Module 7-8: Command Line and PowerShell​

Key Concepts:

  • PowerShell syntax
  • Pipeline and objects
  • Script execution
  • Scheduled tasks

PowerShell Patterns:

# Basic pipeline
Get-Process | Where-Object {$_.CPU -gt 10} | Select-Object Name, CPU

# Loops
foreach ($item in $collection) {
    # processing
}

# Error handling
try {
    # code
} catch {
    Write-Error $_
}

# Scheduled tasks
$action = New-ScheduledTaskAction -Execute "program" -Argument "args"
$trigger = New-ScheduledTaskTrigger -AtStartup
Register-ScheduledTask -TaskName "Name" -Action $action -Trigger $trigger

Module 9: Linux and Processes​

Key Concepts:

  • Processes vs threads
  • Process states
  • Resource management
  • Windows/Linux comparison

Commands:

# Windows processes
Get-Process
Get-Process -Id <PID>
Stop-Process -Id <PID>

# WMI
Get-WmiObject Win32_Process | Select-Object Name, ProcessId, CommandLine

Module 10: Inter-Process Communication​

Key Concepts:

  • Named Pipes
  • Sockets
  • Shared Memory
  • COM/DCOM
  • WMI

Security Risks:

  • Impersonation via pipes
  • Potato attacks
  • Lateral movement via DCOM/WMI

Commands:

# Enumerate pipes
Get-ChildItem \\.\pipe\

# Connections
Get-NetTCPConnection

# WMI
Get-WmiObject Win32_Service

Module 11: Memory and Detection​

Key Concepts:

  • Virtual vs physical memory
  • Working Set, Private Bytes
  • Page File
  • Malware detection

Tools:

  • Task Manager
  • Process Explorer
  • VMMap
  • RAMMap

Analysis Script:

# Top memory processes
Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 10

# System info
Get-CimInstance Win32_OperatingSystem | Select-Object *Memory*

Offensive Techniques to Know​

Reconnaissance​

  • System enumeration (whoami /all, systeminfo)
  • Service and process enumeration
  • Network enumeration

Persistence​

  • Scheduled tasks
  • Registry Run keys
  • Malicious services

Privilege Escalation​

  • Tokens and privileges
  • Vulnerable services
  • Potato attacks

Credential Extraction​

  • Mimikatz and LSASS
  • Pass-the-Hash
  • SAM dumping

Defensive Techniques to Know​

Hardening​

  • Disable unnecessary services
  • Configure the firewall
  • Enable protections (DEP, ASLR, CFG)
  • Credential Guard

Detection​

  • Log analysis
  • Process monitoring
  • Detect suspicious connections
  • Sysmon

Response​

  • Identify IOCs
  • Isolation
  • Basic forensic analysis

Revision Checklist​

Theory​

  • I understand the architecture of an operating system
  • I know the role of BIOS/UEFI and Secure Boot
  • I master NTFS concepts (ACL, ADS, journaling)
  • I understand virtual memory and paging
  • I know Windows IPC mechanisms
  • I understand Windows tokens and privileges

Practice​

  • I know how to use PowerShell for administration
  • I know how to analyze processes and services
  • I know how to configure the registry
  • I know how to create and manage scheduled tasks
  • I know how to analyze network connections
  • I know how to use Sysinternals tools

Security​

  • I understand common attack techniques
  • I know how to detect system anomalies
  • I know best practices for hardening
  • I know how to document an investigation

Last-Minute Resources​

Microsoft Documentation​

Tools​

Survival Commands​

# Quick help
Get-Command *keyword*
Get-Help command -Examples

# System info
systeminfo
Get-ComputerInfo

# Suspicious processes
Get-Process | Where-Object {$_.Path -notlike "C:\Windows\*" -and $_.Path -notlike "C:\Program Files*"}

# Established connections
Get-NetTCPConnection -State Established | Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess

# Non-Microsoft services
Get-WmiObject Win32_Service | Where-Object {$_.PathName -notlike "*\Windows\*"}

Exam Tips​

  1. Read the questions carefully
  2. Test your scripts before submitting
  3. Comment your code
  4. Manage your time effectively
  5. Verify that your solutions work

Good luck! 🎓

Study Guide - Operating Systems Course