Quick Revision - Lecture 8

Windows Objects and Security Context (CST3510 Memory Analysis)

Important for Memory Analysis

This lecture focuses on investigating Windows memory by understanding processes, objects, security identity, permissions and resource relationships.

Key terms to learn first

Executive Object: A resource managed by the Windows kernel.
Object Manager: Creates, protects, names and counts Windows objects.
_EPROCESS: Windows kernel structure containing information about a process.
PID: Process Identifier – a unique number assigned to a process.
SID: Security Identifier – identifies a user, group or logon session.
Access Token: Contains a process's security identity, groups and privileges.
Privilege: Permission to perform a system-level operation.
Handle: A process's reference to an open object.
Handle Table: Records the handles belonging to a process.
Pool Tag: A four-character label used to identify a memory allocation.
Mutant: A named lock, also known as a mutex.
Session: A group of processes sharing a session context.
Window Station: Contains desktops and a clipboard.
Desktop: A display environment that holds windows.
Registry: Windows database containing configuration information.

1. Windows objects

Windows manages resources using the Object Manager.

An Executive Object is a resource managed by the Windows kernel.

Examples:

Process.
Thread.
Token.
File.
Registry key.
Mutant (mutex).
Symbolic link.
Driver.

Object structure:

Object Header: Contains management information, such as type and reference count, and optional security information or name.
Object Body: Contains information specific to that object.

Remember: Not every structure in memory is an executive object.

2. Object lifecycle and memory

Objects can exist in different states:

Allocated: Windows reserves memory for an object.
In use: The object is active and referenced.
Closed or exited: References are removed.
Freed: Memory is marked for reuse, but the bytes may remain.
Partly overwritten: New data replaces some of the old information.

Important: Freed memory does not mean erased memory. Old process records may remain recoverable after a process exits.

3. Kernel pools and pool tags

A Kernel Pool is an area of memory used by Windows kernel components for allocations.

Pool allocations contain metadata.
Metadata includes size, type and a four-byte tag.
Process objects use the tag Proc.

Important: A matching pool tag is only a clue. It does not prove that the memory contains a valid process object.

A scanner checks:

Whether the tag matches.
Whether the size and type are correct.
Whether the object's fields are coherent.
Whether other evidence supports the candidate.

4. Process investigation commands

These are important Volatility commands from the slides.

Command	Purpose
`pslist`	Lists processes linked in the active process list.
`pstree`	Shows parent and child process relationships.
`psscan`	Scans memory for candidate process objects.
`psxview`	Compares several process enumeration sources.

Main difference:

pslist follows the active list maintained by Windows.
psscan searches memory independently for process objects.
pstree reconstructs relationships using parent IDs.
psxview compares different views to identify discrepancies.

Important: A process appearing in psscan but not pslist does not automatically mean it is hidden or malicious. It may simply have exited before the memory capture.

5. Classifying process records

Four possible classifications:

Classification	Meaning
Active	Process is currently active and supported by other evidence.
Residual	Process has terminated, but its memory record remains.
Invalid or incomplete	Damaged record, false match or missing memory pages.
Unexplained	Evidence does not yet provide a clear explanation; requires further investigation.

Investigation rule: A discrepancy is a lead, not proof of an attack.

6. Other Windows object scanners

Scanner	What it can recover
`psscan`	Process objects
`thrdscan`	Thread objects
`filescan`	File objects
`mutantscan`	Mutant/mutex objects
`symlinkscan`	Symbolic link objects
`wndscan`	Window station objects
`deskscan`	Desktop objects
`driverscan`	Driver objects

Remember the investigation process:

Candidate → Validate → Relate → Interpret

7. The Windows process object (_EPROCESS)

The _EPROCESS structure contains information about a process.

Important fields:

PID: Process ID.
Image name: Executable filename.
Create time: When the process started.
Exit time: When the process terminated; empty if it is still running.
Parent ID: Parent process PID.
Session number: Which Windows session the process belongs to.

The process object also links to:

Active process list.
Threads.
Access token.
Handle table.
Process memory.

Important: A process name is only a label. You need more evidence to understand its identity and activity.

8. Normal Windows processes

Learn these common process names and their general roles.

Process	Role
`System`	Kernel activity
`smss.exe`	Creates sessions
`csrss.exe`	Supports sessions
`lsass.exe`	Security policy and logons
`wininit.exe`	Starts the service side
`services.exe`	Starts and manages services
`svchost.exe`	Hosts multiple services
`winlogon.exe`	Handles interactive logon
`explorer.exe`	User desktop shell

Session 0: Service-side processes.

Session 1 and later: Usually interactive user sessions.

A Windows service is a background program started and managed by services.exe.

9. Identity, capability and activity

These are four different types of evidence:

Identity: Whose security context is the process running under?
Capability: What is the process allowed to do?
Access relationship: Which objects or resources is it connected to?
Demonstrated activity: What did the process actually do?

Example: A process having SeDebugPrivilege and a handle to another process does not automatically prove that it performed code injection.

10. Security Identifiers (SIDs)

A SID identifies a:

User.
Group.
Logon session.

Windows uses SIDs for security decisions. Names are looked up afterwards.

Important examples:

SID	Meaning
`S-1-5-18`	Local System
`S-1-5-32-544`	Administrators
`S-1-1-0`	Everyone

Important: A SID without a resolved name is not automatically suspicious.

11. Access tokens

An Access Token describes a process's security context.

It normally contains:

User SID.
Group SIDs.
Privileges.

Windows checks the process's token against the object's security information when access is requested.

If access is allowed, Windows returns a handle with the granted access.

Remember: A token describes security context, not a person's intentions.

12. Windows privileges

A Privilege allows a system-level operation.

Three important differences:

Present: The privilege exists in the token.
Enabled: The privilege is switched on and can be used.
Used: Separate evidence demonstrates that the privilege was actually used.

Important examples:

Privilege	What it allows
`SeDebugPrivilege`	Debug and adjust the memory of other processes.
`SeBackupPrivilege`	Read files regardless of their access lists for backup.
`SeLoadDriverPrivilege`	Load or unload a device driver.

Exam point

Present does not mean enabled, and enabled does not prove use.

13. Handles and handle tables

A Handle is a reference a process uses to access an open object.

A Handle Table records the handles belonging to a process.

Handles can connect processes to:

Files.
Registry keys.
Other processes.
Threads.
Mutexes.
Symbolic links.

Example: A process may have a handle to:

C:\ProgramData\maint\queue.db

This tells an investigator that the process had an open relationship with that file at the time of capture.

What handles do not prove:

Who caused the access.
Whether the file was read or written.
Whether the process created the object.
Whether a file was executed.
The process's intentions.

Always corroborate handle evidence with other information.

14. Named objects

Examples of object relationships:

File: Shows which file path was open.
Registry key: Shows which configuration location was accessed.
Process: Shows a reference to another process.
Mutant / Mutex: A named lock, sometimes used to ensure only one instance of a program runs.
Symbolic link: An alias pointing to another object or device path.

Important: A mutex name alone does not identify malware.

15. Sessions, window stations and desktops

The relationship works like this:

Session

Window Station

Desktop

Threads attach to a desktop

Session: Groups processes sharing a session context.
Window Station: Contains desktops, clipboard and atom table.
Desktop: Contains windows and hooks.
Threads: Attach to a desktop.

Session 0: Service-side and normally noninteractive on Windows 7.

Session 1 and later: Usually interactive user sessions.

WinSta0: The interactive window station. However, seeing WinSta0 alone does not prove that a user is actively interacting with the process.

16. How to investigate Windows memory

Learn this sequence:

Start with a process or object.
Compare process lists and memory scans.
Classify the process as active, residual, invalid or unexplained.
Examine its SID, token and privileges.
Investigate its handles and connected resources.
Examine its session and desktop.
Explain the evidence, its limitations and the next check.

Main takeaway: Do not make conclusions from one command or one suspicious-looking result. Compare different evidence sources and explain what they do and do not prove.

Quick revision: important comparisons

Topic	Remember the difference
`pslist` vs `psscan`	Active process list vs independent memory scan
`pstree` vs `psxview`	Parent/child relationships vs comparing process views
Active vs residual	Running process vs terminated process with recoverable memory
SID vs access token	SID identifies a security principal; token contains security context
Present vs enabled privilege	Exists in token vs switched on
Enabled vs used privilege	Can be used vs evidence proves it was used
Handle vs handle table	Reference to an object vs list of process handles
Backup vs archive	Regular copies for recovery vs long-term data retention
IDS vs IPS	Detects suspicious activity vs helps prevent it
VM vs hypervisor	Virtual computer vs software that manages virtual computers
WEP vs WPA2	Older wireless security vs stronger IEEE 802.11i-based security

Most important terms to memorise

Wireless Security: IEEE 802.1X, WPA2, RSN, EAP, TKIP, CCMP, MITM, MAC spoofing, BSS, DoS.

Operating System Security: OS hardening, patch management, least privilege, defence in depth, UAC, EFS, BitLocker, hypervisor, honeypot.

Windows Memory Analysis: _EPROCESS, PID, SID, access token, SeDebugPrivilege, SeBackupPrivilege, handle, handle table, pool tag, pslist, psscan, pstree, psxview, mutantscan, session, window station and desktop.

Revision tip: Learn the definitions first, then practise explaining what each command or security feature does and what its limitations are.