Windows Foundations

This track is about driving a Windows system the way a defender actually has to: from the command line and PowerShell, through the file system and its permission model, through Active Directory, the system most companies use to manage every computer at once, into the Event Log and registry where most of the evidence lives. Seven lessons take you from your first PowerShell prompt to the places an analyst checks first during triage, such as logon events in the Security log and the registry keys malware abuses to survive a reboot.

Every lesson is hands-on on a real Windows 10 or 11 install, using only tools that already ship with it, no extra installs required. If you’re not on Windows day to day, the first lesson explains the free options for getting access, the same way the Linux Essentials track explains WSL for Windows users going the other way.

Windows still runs the overwhelming majority of corporate desktops and a large share of servers, which makes it the single most common environment a defender investigates. When something here raises a question the lessons don’t answer, take it to the community Discord.