In the last module, we tried to modify the Windows registry using the regedit tool to turn on the antivirus, but we couldn't write to the registry key even though we were using Administrator-level privileges. Then we did the same with the "Windows Security" application and the modification was successful. But *why*?

## Procmon

Mark Russinovich (a guy with that name) has done a lot of great work with the internals of Windows and released a toolset called "Sysinternals" which is still useful for examining Windows' operations.

The tools are installed and ready on the IIS1 server. Let's start the investigation by launching the "ProcMon" tool. You can find the sysinternals tools both on the desktop and under C:\\SysinternalsSuite.

![](sanity:image-2e7643b281d54370bf40e11a16d31ea9033697b8-1458x1166-png)

Open "Procmon" and accept the terms of use if necessary.

Procmon monitors real-time handling of, for example, files and the registry.

---

## Registry key monitoring

Procmon can show a lot of events and interesting events easily get lost in the mix. Let's create a filter that narrows down the events so that the path contains the words "Real-Time Protection". This way, hopefully we can find out who or what writes to the key "**HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection**" and with what permission.

![](sanity:image-a6405415378c34628fa3eb707f12b85d0d8e4085-754x344-png)

![](sanity:image-23093583c6ba85fc724c8f0de60daf04f3cd3834-1140x678-png)

After adding the filter (remember to click "Add"), open regedit.exe as in the previous module and go check the value of the key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection** again. Procmon should immediately display registry events such as **RegOpenKey** and **RegCloseKey**.

![](sanity:image-acb11ef130a5ebae033385d257e3210ba85d760d-1516x814-png)

---

## Enabling Virus Protection

Next, open "Windows Security" and periodically empty the notifications with the red trash can icon.

![](sanity:image-6bba14542a1ed3ed03f331c2a5de34abe4d638d8-1236x1194-png)

Turn off antivirus again (Manage settings -> Real-Time protection -> Off).

![](sanity:image-580a46fe3e3d685a14fcb1de9f07f11305f2b853-988x394-png)

Examine ProcMon results now. Pay attention to the "**RegSetValue**" event.

![](sanity:image-651428189481d191fed0faf1cd304f70c7ec10af-1300x220-png)

---

## Investigating the incident

Double click to open the registry event and open the "Process" tab. The registry key was updated by "MsMpEng.exe" (Antimalware Service Executable) which is running with SYSTEM privileges. "Service Executable" refers to a service (Windows Service), so let's open services next.

![](sanity:image-568f5f3a20c0b09e28cb18e0cfcd6a00603a6084-1482x938-png)

---

## Services

Windows services are programs or processes that run in the background of the Microsoft Windows operating system. They perform various tasks and functions, such as file sharing, network connection management, printing, security, and system monitoring.

Windows services can be started automatically at startup or manually as needed. They operate independently or interact with other services and programs. Many system components and applications rely on Windows services to function correctly.

You can manage Windows services using the "Services" management tool, which you can access by opening the "Run" menu (Windows key + R) and typing "services.msc". From here, you can start, stop, pause, or configure the startup type of services, such as automatic, manual, or disabled.

Open this view now. Scroll down until you find the "Windows Defender Antivirus Service" service and double-click it to open.

![](sanity:image-577237d2f4abab4d1f30ebd119195a93930077f2-1962x1116-png)

Note that "executable" is indeed "MsMpEng.exe" and the user is "SYSTEM".

![](sanity:image-46e6b67593c96acdb9bd97941dbc1af5e8227506-788x458-png)

![](sanity:image-2233a92f602142cc7f916d41648c1a07387e9f66-796x304-png)

---

## SYSTEM user

System, LocalSystem or "NT Authority/System" all mean the same thing, the Windows "SYSTEM" user account ('SYSTEM' user account), which is a special and highest-level user account in Microsoft Windows operating system. It is part of the system's core functions and has wide administrative rights over the entire system.

The ""SYSTEM"" user account is separate from regular user accounts and administrator accounts. It is created during system installation and has access to system files, the system registry, services, and other system resources.

This user account is used specifically for executing Windows core processes and services. Many background services and processes operate with the privileges of the "SYSTEM" user account. This is necessary in order for critical system functions to operate correctly and to ensure system stability.

---

## Bottom Line

The solution to the mystery is that the "Windows Security" application communicates with the running Windows Defender service as the SYSTEM user, which made the registry change. How exactly the communication between the application and the service took place remains a mystery for another time.

@exercise af440a25c2c8


This is a scenario, please do not unnecessarily close it within the same course area (Scenario 1) so that you do not lose your progress. Please add time if necessary. It may take a few minutes for the scenario to start, please wait patiently.

Evilcorp - Scenario 1

Procmon, Services and Administrator vs. SYSTEM rights

Windows and Active Directory attacks and defense

Windows is widely used in the IT environments of numerous companies and educational institutions, and Windows networks are typically managed through an Active Directory domain.

In this course, we will explore the security of the Windows operating system and Active Directory from the perspectives of both attackers and defenders. Some of the tasks involve attacks, while others are hardening tasks.

The scope of the course (Windows, attack and defense) is quite broad. If one were to study it purely in theory, the course would be dull. On the other hand, without any theory, there would be no hacking because both attack and defense rely on understanding what is happening.

We chose, for these reasons, to implement the course using a scenario-based approach, where each section of the course deals with one "scenario" that may include a few attacks, a few tools, and a few hardenings to protect against the attacks.

The theory is covered in small pieces in practical context, always when necessary. Things are tried to be understood at the bit level in order to avoid the unfortunate phenomenon typical of such courses where the student knows how to try the psexec attack after obtaining the NTLM hash, but does not understand at all what the attack does and how it works (spoiler: psexec is based on the Service Control Manager RPC interface, which launches the desired command as a Windows service on the target server). Let's peek under the hood with Wireshark and dig into the source code of modules, for example, Metasploit.

This way, a comprehensive and theoretical topic will hopefully become fun and easily approachable step by step.

Are you ready to break into EvilCorp's corporate network?

The course does not require knowledge of Windows environments, but otherwise basic things like Linux, computer networks, nmap, etc. would be good to have. Welcome to the course!

This course is still under construction, more scenarios will be added.

This course is in BETA mode, please let us know if you come across any misaligned bits.

Procmon, Services and Administrator vs. SYSTEM rights

Learn to hack — start here