Operating System Components: Windows and Linux

What it is

An operating system is made of components that an analyst must recognise, because attackers leave traces in each of them.

The main components are the kernel, processes, services, the file system, user accounts and permissions, configuration storage, and logs. Windows and Linux hold these in different places.

The exam gives a scenario and asks you to name the component involved, for example a service that starts at boot, or a configuration file.

How it works

Each component has a role, a Windows form and a Linux form.

Core components

Windows

The registry is a database of settings. Attackers use run keys to make malware start at login or boot.

C:\> reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
C:\> tasklist
C:\> netstat -ano

The first command lists programs that start automatically for all users. tasklist lists processes, and netstat -ano shows connections with the process ID that owns each one.

Key places in Windows include the Windows folder and its system files, the Program Files folders for installed software, and user profile folders.

Temporary folders are common places for dropped malware. Services run in the background, and an unknown service can be a persistence method. The Event Viewer shows logs.

Linux

Linux arranges everything in a single tree starting at the root, written as /.

$ ps aux
$ ss -tulnp
$ systemctl status ssh
$ ls -l /etc/passwd

ps aux lists processes for all users. ss -tulnp lists listening ports and the processes behind them.

systemctl status shows the state of a service, and the unit name can differ by distribution, for example ssh or sshd. ls -l shows file permissions and owners.

Linux permissions use read, write and execute for the owner, the group and everyone else. A file readable and writable by everyone, or a program with the setuid bit set, deserves a close look.

Using components in a scenario

Match the clue to the component.

• A program that starts every time the machine boots points to a service, a registry run key on Windows, or a systemd unit on Linux.
• An unknown program listening on a port points to a process with a network connection.
• A changed configuration points to the registry on Windows or a file in /etc on Linux.
• A deleted or edited log points to the log store on that platform.
• A script in a temporary folder points to the file system.

Memory and the kernel

Running processes live in memory. When a machine is powered off, memory is lost, so analysts capture running processes and connections first. This matters again in the forensics topics later in the course.