This documentation explains folder and file permissions, process and file internals, and event log identifiers relevant to system security.
Understanding permissions, file types, process relationships, and event log identifiers is important for maintaining secure and properly functioning systems. Incorrect permissions or misconfigured access controls can lead to unauthorized access, data exposure, or undetected compromise. This repository provides a clear, structured explanation of these topics.
Scope: This is a defensive and detection reference. It does not contain exploit code, working injection payloads, or offensive tooling. All ATT&CK mappings, event IDs, and technique descriptions are documented solely at the detection and identification level.
Live Version:View the interactive tools and Knowledge Base.
| # | File | Topic |
|---|---|---|
| 01 | Unix Permissions | rwx model, octal table, setuid/setgid/sticky, POSIX ACLs, extended attrs, web-root baselines |
| 02 | Windows NTFS Permissions | NTFS permission model, inheritance, icacls/Get-Acl, common misconfigs |
| 03 | Windows File Types | PE format basics, common extensions, abuse patterns |
| 04 | DLL Types and Loading | DLL types, search order, side-loading, injection techniques at detection level |
| 05 | Threads and Processes | Thread vs process, remote threads, APC injection, process hollowing — detection artifacts |
| 06 | Process Tree Construction | PID/PPID relationships, expected Windows process tree, suspicious chains, command-line analysis, and LOLBin reference |
| 07 | Windows Event IDs | Security event ID reference grouped by category |
| 08 | Sysmon Event IDs | Sysmon event ID reference, schema 4.90/4.91 |
| 09 | Event ID Ranges by Source | Quick lookup: ID range → log source |
| 10 | Registry Hives and Persistence | The five hives, persistence keys, process tree connection |
| 11 | Ports and Protocols | Common ports with detection relevance notes |
| 12 | HTTP Status Codes | Full 1xx–5xx reference with security annotations |
| 13 | MITRE ATT&CK Quick Map | Cross-reference index: techniques mapped to ATT&CK IDs |
| 14 | Email Headers and Phishing | SPF/DKIM/DMARC, header analysis, homograph/lookalike domains, phishing indicators |
| 15 | File Hashing and Identification | MD5/SHA1/SHA256, cryptographic integrity, imphash, ssdeep/fuzzy hashing |
| 16 | Windows Scheduled Tasks | Architecture, triggers, actions, schtasks, Task XML, event IDs, persistence |
| 17 | Windows Auth Fundamentals | Auth vs authz, LSASS/LSA/SAM, NTLM challenge-response, Kerberos ticket flow, logon types |
| 18 | Linux Filesystem | FHS overview, purpose of core directories, security/forensic artifacts |
| 19 | Linux Processes and Logging | PID/PPID, process states, /proc, syslog/journald, auditd fundamentals |
| 20 | Security Fundamentals | CIA triad, AAA, defense in depth, least privilege, threat/vulnerability/exploit/risk definitions |
| Tool | Description |
|---|---|
| Permission Calculator | Unix rwx/octal toggle with symbolic string, octal, and description outputs |
| Process Tree Viewer | Example trees (normal boot, Office macro chain, PPID spoofing) with ATT&CK ID mapping |
- General navigation: Search (Ctrl+F / Cmd+F) within a document, or use the interactive tools.
- Event ID reference: Consult 07 or 08. For unfamiliar sources, refer to 09.
- Process trees: Use 06 for expected relationships. Associated ATT&CK IDs are indexed in 13.
- Permissions: See 01 for Unix, 02 for Windows, or access the permission calculator.
MIT — see LICENSE.