Save
Upgrade to remove ads
Busy. Please wait.
Log in with Clever
or
show password
Forgot Password?
Don't have an account?  Sign up 
Sign up using Clever
or
Username is available taken
show password


Make sure to remember your password. If you forget it there is no way for StudyStack to send you a reset link. You would need to create a new account. Your email address is only used to allow you to reset your password. See our Privacy Policy and Terms of Service.

Already a StudyStack user? Log In

Reset Password
Enter the associated with your account, and we'll email you a link to reset your password.
focusNode
Didn't know it?
click below
 
Knew it?
click below
Don't Know
Remaining cards (0)
Know
0:00
edit
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.

  Normal Size     Small Size show me how

WIndows Info

This is general info that I come across and want to reinforce over time

TermDefinition
Kerberos. Event ID 4768. Event ID 4768. It's a critical event to monitor because it shows when a system or user attempts to authenticate using the Kerberos protocol.
Kerberos TGT - Suspicious info Unexpected IP address. TGT request for high-privilege accounts. Frequent TGT requests.
MS-EFSRPC Encrypting File System Remote Protocol
NTLM (NT LAN Manager) Windows authentication protocol that's primarily used for authenticating users and services within a Windows domain. NTLM has been around since the 1990s, and while it has been largely replaced by Kerberos.
NTLM -- PROCESS Challenge/Response: When a user tries to authenticate to a service (e.g., a file share), the client sends a request to the server. The server responds with a "challenge", and the client encrypts a response using the user's password hash.
Kerberos TGT OR TICKET GRANTING TICKET TGT is the initial ticket then there is a service ticket for services after the initial ticket issue granted.
Kerberos process 5 step process - 1. The client sends a request Auth Server. 2. AS checks the request issues a tgt/session key. 3. User requests a service T and time stamp applied. 4. service ticket granted. 5. service T used to accedes service.
Why svchost.exe Uses Network Connections Connecting to Microsoft or Windows update servers. DNS lookups via DNS client services. Time synchronization through NTP servers Remote Desktop Services. bad guys can use svchost.exe to hide.
Delivery Optimization Service svchost.exe - windows delivery optimization service or DoSvc. used for updates.
device namespace format. it’s a low-level system path representing a specific volume (partition) on a hard disk. Windows uses these device paths internally in the kernel, drivers, and some APIs to access disks and volumes directly, bypassing the drive letter mapping.
RPC Remote procedure call -Remote Procedure Call (RPC) is a core Windows technology that allows one process to request services or operations from another process, even if it's on a different computer on the network.
Userassist UserAssist is a feature in Microsoft Windows that tracks and stores information about programs and features a user runs. It’s mainly used for generating usage statistics to help optimize the user experience (like recently used programs lists)
Userassist - location of where its stored HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
System Service Dispatch Table (System Call Table) System Call Table -This is a crucial data structure within the operating system's kernel. It's essentially a table (like an array) that holds the memory addresses of all the legitimate "system call" functions provided by the kernel.
System Call Table (System Service Dispatch Table) System Service Dispatch Table - This is a crucial data structure within the operating system's kernel. It's essentially a table (like an array) that holds the memory addresses of all the legitimate "system call" functions provided by the kernel.
Created by: daryl.davis
 

 



Voices

Use these flashcards to help memorize information. Look at the large card and try to recall what is on the other side. Then click the card to flip it. If you knew the answer, click the green Know box. Otherwise, click the red Don't know box.

When you've placed seven or more cards in the Don't know box, click "retry" to try those cards again.

If you've accidentally put the card in the wrong box, just click on the card to take it out of the box.

You can also use your keyboard to move the cards as follows:

If you are logged in to your account, this website will remember which cards you know and don't know so that they are in the same box the next time you log in.

When you need a break, try one of the other activities listed below the flashcards like Matching, Snowman, or Hungry Bug. Although it may feel like you're playing a game, your brain is still making more connections with the information to help you out.

To see how well you know the information, try the Quiz or Test activity.

Pass complete!
"Know" box contains:
Time elapsed:
Retries:
restart all cards