Chapter 12 — Operating systems
Lesson map
Lesson 12 published. Map, example, EX023.
flowchart TD
N0["Learning outcomes and connection"]
N1["12.1 Host state"]
N2["12.3 Observation points and agent design"]
N3["12.4 Baselines"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX023"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["12.1 Host state"]
N2["12.3 Observation points and agent design"]
N3["12.4 Baselines"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX023"]
[Learning outcomes and connection]
|
v
[12.1 Host state]
|
v
[12.3 Observation points and agent design]
|
v
[12.4 Baselines]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX023]
Learning outcomes and connection
After this chapter you can (1) model host state as processes, services, accounts, files, permissions and scheduled tasks; (2) explain what operating-system logs record and what they miss; (3) specify safe observation points for a response agent; and (4) distinguish expected from anomalous behaviour with a documented baseline. It builds on Chapter 8 and prepares Chapters 28 and 34.
12.1 Host state
The kernel mediates access to hardware and enforces permissions; user-space processes run under identities with privileges. Persistence mechanisms — services, scheduled tasks, startup entries, cron jobs — are ordinary administrative features that attackers reuse. A responder's model of a host lists: running processes with parent, user and command line; services and their accounts; scheduled tasks; local accounts and group memberships; listening sockets; recently modified executables; and installed updates. On the HVSS finance workstation of the next subsections, that model includes the two service accounts and the scheduled task UpdateCheck.
12.2 Logs and their limits
Operating systems log authentication, process creation (if enabled), service changes and policy changes. Logging must be configured: process command-line capture, for instance, is often off by default. Logs live on the host, so an attacker with administrative rights can clear or alter them; forwarding to a separate store quickly is what makes them evidence (NIST SP 800-92 covers log management). Kernel-level activity — a malicious driver — may not appear in user-space logs at all. On that workstation, the encoded UpdateCheck command is visible only if command-line capture was enabled.
12.3 Observation points and agent design
A response agent is itself privileged software and therefore a target and a risk. Design rules: run with the minimum privilege needed for each function (collection may need read access to memory; isolation needs network-stack control — separate them); sign and verify agent updates; log every command the agent executes to a store it cannot modify; rate-limit actions; and fail safe — if the agent loses contact with its control service, it continues collecting but does not initiate containment on its own (Chapter 33).
12.4 Baselines
"Anomalous" needs a reference. Build baselines per host role: expected services, scheduled tasks, accounts and parent–child process pairs. A synthetic HVSS finance workstation runs two service accounts: svc-backup (runs nightly at 01:00, reads user folders) and svc-update (runs the vendor updater weekly). An observed scheduled task named UpdateCheck running powershell.exe -enc ... as svc-update at 03:17 daily differs from baseline in three ways: interpreter instead of the updater binary, encoded command, daily schedule. Expected behaviour can still be malicious and anomalies can be benign (a new legitimate tool), so the baseline triggers investigation, not verdict.
12.5 Worked example (synthetic): safe observation
Specification for collecting on that workstation: (1) export scheduled task definitions and the task's history; (2) capture process list with command lines and parents; (3) copy the task's referenced script if any, hashing before and after copy; (4) query the authentication log for svc-update logons; (5) do not run the encoded command to "see what it does" on the host — decode it as text offline. Each step records the command, time, operator and output hash. Step 5 is the one most often skipped under pressure, and EX023 practises it with Python on an analysis machine.
12.6 Errors and limits
- Assuming logging is enabled because the OS supports it.
- Running unknown commands on the suspect host to understand them.
- One all-powerful agent identity.
- Treating baseline deviation as proof.
The HVSS finance workstation from the baseline example shows where each error bites. If command-line capture was never switched on, the -enc argument of UpdateCheck would not appear anywhere in the logs. Running the encoded command to understand it would execute the attacker's code under svc-update. An agent that holds both memory-read and isolation rights under one identity is the target EX024 asks you to split. The three deviations from baseline still justify investigation, not a verdict.
Exercises — chapter 12
EX023 — Decode safely. Objective: inspect without executing. Inputs: the synthetic encoded command SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAKQA= (Base64 of UTF-16LE text). Steps: decode it offline in Python without running it; report the text and what it suggests. Expected evidence: code and decoded string. Rubric: 3 = correct decode (IEX (New-Object)) with interpretation as an in-memory execution pattern, truncated; 2 = decode only; 1 = attempt; 0 = ran it.
EX024 — Agent privileges. Objective: design least privilege. Inputs: agent functions: process listing, file hashing, memory capture, network isolation, self-update. Steps: group them into privilege tiers and state controls for each tier. Expected evidence: table. Rubric: 3 = isolation and memory capture separated with approval/scope controls, signed update, immutable command log; 2 = partial; 1 = single tier; 0 = none.
Chapter synthesis
Model host state explicitly, know which logs exist and how they can be defeated, design agents as least-privileged and auditable software, and use role baselines to direct investigation rather than to deliver verdicts.
Continue studying — chapter 12 of 50
← Chapter 11 · Course chapter index · Chapter 13 →
Continue to the next authored lesson.