2.1.2. OS Concepts for Security Analysts
💡 First Principle: Attackers live in the operating system — they use legitimate OS features (scheduled tasks, registry, processes) to execute and persist. Analysts who understand normal OS behavior can recognize when those features are being abused.
The OS is not just a platform the attacker targets; it's the toolkit they use after gaining access. Understanding normal OS behavior is the prerequisite for recognizing abnormal behavior.
Windows Registry is a hierarchical database storing OS and application configuration. From a security perspective, attackers use it for persistence (adding entries to auto-run keys so malware survives reboots) and for storing configuration data that would be suspicious as a file. Key locations to know:
| Registry Key | Security Significance |
|---|---|
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Runs programs at system startup — common persistence location |
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Runs programs at user login — user-level persistence |
HKLM\SYSTEM\CurrentControlSet\Services | Service configurations — attackers register malicious services here |
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options | Used in "debugger" hijacking attacks |
System hardening reduces attack surface by removing or disabling unnecessary features before a system is deployed. CIS Benchmarks provide specific, scored configuration recommendations for every major OS. A hardened system starts with fewer exploitable services, weaker default credentials, and less attack surface — making post-compromise analysis cleaner because "normal" is more constrained.
File structure matters because attackers hide malicious files in predictable locations. On Windows, C:\Windows\System32\ should only contain legitimate system files — malware dropped there mimics legitimate binaries. On Linux, /tmp/ and /var/tmp/ are common staging areas because they're writable by all users. Analysts should know the expected file structure to recognize anomalies.
System processes have expected parent-child relationships. explorer.exe should spawn user applications, not cmd.exe or powershell.exe spontaneously. lsass.exe (Local Security Authority Subsystem) should only have one instance running — a second instance is a classic indicator of credential dumping malware. Process tree analysis is a core forensic technique.
⚠️ Exam Trap: The Windows Registry is not only used for persistence — it can also store encrypted payloads, configuration data for fileless malware, and evidence of past activity (MRU lists, recently accessed files). When exam questions ask about registry analysis, think beyond just startup keys.
Reflection Question: An endpoint protection tool flags an instance of svchost.exe running from C:\Users\Public\ rather than C:\Windows\System32\. Why is this suspicious, and what category of attacker technique does this represent?
