An Operator must understand how systems actually function before attempting to manipulate them.
| Windows | Linux |
|---|---|
| User Mode | User Space |
| Win32 API | glibc |
| ntdll.dll | syscall wrapper |
| System Call | System Call |
| NT Kernel | Linux Kernel |
| Driver | Kernel Module |
| Service | Daemon |
| SCM | systemd |
| SYSTEM | root |
| Token | UID/GID/Capabilities |
| Registry | Configuration Files |
| ETW | auditd/eBPF/journald |
| LSASS | PAM/SSSD/OpenLDAP |
| Scheduled Task | cron/systemd timer |
Introduction
"Every action performed on a computer eventually reaches the operating system."
The operating system (OS) is the layer between software and hardware.
Applications do not directly interact with the CPU, memory, disks, network cards, keyboards, or monitors.
Instead, applications request services from the operating system, which coordinates and controls access to system resources.
Core Responsibilities of an Operating System
An operating system performs several major responsibilities.
Resource Management
The operating system manages:
- CPU time
- Memory allocation
- Storage access
- Network communication
- Peripheral devices
Without resource management:
- Programs would interfere with each other
- Memory corruption would be common
- System stability would collapse
Process Management
The operating system controls:
- Process creation
- Process termination
- Process scheduling
- Process isolation
- Process permissions
Understanding processes is therefore critical for:
- Detection
- Threat hunting
- Malware analysis
- Incident response
- Privilege escalation
Memory Management
The operating system controls:
- Memory allocation
- Memory protection
- Virtual memory
- Memory isolation
- Paging
Examples:
| Scenario | OS Responsibility |
|---|---|
| Chrome requests memory | Allocate pages |
| Process crashes | Handle exception |
| System runs out of RAM | Use page file/swap |
| Malware injects code | Memory protections become relevant |
Many offensive and defensive techniques revolve around memory.
Examples:
- DLL injection
- Process injection
- Shellcode execution
- Memory forensics
- Credential extraction
File Management
The operating system controls:
- Files
- Directories
- Ownership
- Permissions
- Metadata
Examples:
| Activity | File System Involvement |
|---|---|
| Save document | Write file |
| Install software | Create files |
| Download malware | Create file |
| Delete evidence | Remove file |
| Persistence | Store executable |
Many investigations begin with file artifacts.
User Management
The operating system controls:
- Users
- Groups
- Authentication
- Authorization
- Security boundaries
Examples:
| User | Access |
|---|---|
| Administrator | High |
| Standard User | Limited |
| Service Account | Application-specific |
| SYSTEM / Root | Highest |
Many attacks revolve around:
- Obtaining privileges
- Escalating privileges
- Impersonating users
- Stealing credentials
Permission Management
Operating systems enforce security boundaries.
Examples:
| Resource | Controlled By |
|---|---|
| Files | Permissions |
| Folders | Permissions |
| Registry | Permissions |
| Services | ACLs |
| Processes | Security tokens |
| Network resources | Authentication |
Security fundamentally depends on permission enforcement.
Networking
The operating system provides:
- TCP/IP stack
- DNS resolution
- Routing
- Firewall integration
- Socket management
Without operating systems:
- Browsers cannot access websites
- Servers cannot accept connections
- Applications cannot communicate
Networking concepts later appear throughout:
- Web
- Active Directory
- Cloud
- Red Teaming
- Blue Teaming
Logging and Telemetry
Operating systems record activity.
Examples:
| Platform | Telemetry Source |
|---|---|
| Windows | Event Logs |
| Linux | Journal |
| Linux | Syslog |
| Windows | ETW |
| Both | Application Logs |
These logs become evidence during:
- Incident Response
- Threat Hunting
- Forensics
- Detection Engineering
Common Operating System Components
Although implementations differ, most operating systems contain similar components.
| Component | Purpose |
|---|---|
| Kernel | Core operating system |
| File System | Data storage |
| Process Manager | Execution control |
| Memory Manager | Memory allocation |
| Scheduler | CPU allocation |
| Network Stack | Communications |
| Security Subsystem | Authentication and authorization |
| Logging Subsystem | Telemetry generation |
| Shell | User interaction |
| Service Manager | Background services |
Windows vs Linux
The two dominant operating systems encountered by Operators are Windows and Linux.
Many concepts are shared.
| Concept | Windows | Linux |
|---|---|---|
| Files | NTFS | ext4/xfs/btrfs |
| Users | Local Users | Local Users |
| Groups | Local Groups | Groups |
| Privileges | Tokens & Rights | Root, Sudo, Capabilities |
| Services | SCM | systemd |
| Scheduled Execution | Task Scheduler | Cron / Timers |
| Logs | Event Viewer | Journal / Syslog |
| Shells | CMD / PowerShell | Bash / Zsh |
| Configuration | Registry | Configuration Files |
| Highest Privilege | SYSTEM | Root |
Different implementations.
Same underlying concepts.
Operating Systems Through the Operator Lens
When entering a system, Operators typically ask:
Files
- What files exist?
- What directories exist?
- What data is stored?
Users
- Who uses this system?
- Who has administrative rights?
- What accounts exist?
Privileges
- What permissions are available?
- Can privileges be elevated?
Processes
- What is running?
- What executed recently?
- What spawned what?
Services
- What starts automatically?
- What runs in the background?
Networking
- What connections exist?
- What systems communicate?
Telemetry
- What evidence exists?
- What happened?
- When did it happen?
Notice that every question maps directly to an operating system component.
This is why operating systems serve as the foundation for everything that follows in OOTW.
What You Will Learn
The Windows and Linux sections will focus on:
Windows
- File Systems
- Users & Groups
- Privileges & Integrity Levels
- Processes
- Networking
- Services
- Scheduled Tasks
- Registry
- Telemetry
- Shells
Linux
- File Systems
- Important Locations
- Users & Groups
- Privileges
- Networking
- Services
- Automated Tasks
- Telemetry
- Shells
By the end of this chapter, the student should be comfortable navigating both operating systems and understand how the major operating system components interact with one another.
Everything built later in OOTW depends on this foundation.