Windows Infrastructure
Offensive and defensive reference for Windows hosts: architecture basics,
enumeration, local privilege escalation, and persistence. This subcategory
covers standalone and domain-joined Windows systems; Active Directory
domain-level attacks live in the parent 01 Active Directory category.
This subcategory uses the two-track format (Offensive / Defensive). See the parent INFRASTRUCTURE README for the format skeleton.
Files
| # | File | Focus |
|---|---|---|
| 01 | Windows Fundamentals | Architecture, registry, SCM, SID, ACL, tokens, integrity, UAC |
| 02 | Enumeration and Misconfigurations | WinPEAS, Seatbelt, services, tasks, autologon, Unattend, config files |
| 03 | Local Privilege Escalation | Unquoted paths, weak service/DLL perms, token privileges, SeImpersonate, kernel exploits |
| 04 | Persistence and Defense | Run keys, scheduled tasks, services, WMI subscriptions, hardening, Sysmon detection |
Scope
In scope:
- Windows 10 / 11 workstations.
- Windows Server 2016-2025 member servers.
- Windows Server Core installations.
- Standalone and domain-joined hosts (host-level attacks only;
domain-level attacks are in
01 Active Directory).
Out of scope:
- Active Directory domain attacks (Kerberoasting, DCSync, trusts) -
see
01 Active Directory. - Cloud-hosted Windows (Azure VM specific features) - see the CLOUD category.
- Virtualization-specific escapes - see the VIRTUALIZATION category.