Windows Endpoint Architecture
What is it?
A Windows endpoint is organized into processes (running programs, each with a parent), services (background programs, often SYSTEM), the registry (configuration), the file system, memory, and a security model of users, groups and privileges enforced by access tokens. Attacks manifest as anomalies in these structures — an odd process parent, a new service, a suspicious registry key, a token elevated.
Why it matters
You read attacker behavior by knowing what normal structure looks like. Without the architecture model, an odd process lineage or a rogue service is invisible; with it, they stand out.
Where you see it
The mental model behind every endpoint investigation.
What normal looks like
Processes descending from canonical parents, services signed and expected, registry and tokens matching the host's role.
What suspicious looks like
A process whose parent violates the OS's rules, a service pointing at a user-writable binary, or a standard user holding an elevated token — architectural anomalies.
How analysts investigate
By comparing observed structure against the OS's known rules (canonical parents, expected services, normal privilege assignments) and investigating the deviations.
Common beginner mistakes
- Trying to spot anomalies without knowing the baseline structure — you cannot recognize an impossible process parent if you do not know the possible ones.
Quick check
Why must an endpoint analyst understand the normal Windows process/service/privilege structure?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.