~/projects/windows-security-research/README.md

Windows Security Research

status: ongoing source: private type: security research

windows internalsuaccomprivescdetectionsysinternals

what it is

An ongoing private research project into how Windows actually enforces privilege boundaries — specifically UAC, COM interfaces, and auto-elevation behavior — and what that activity looks like to a defender.

problem / objective

Windows privilege separation has documented seams — auto-elevated binaries, COM interfaces callable across the boundary, and behavior that differs between documentation and implementation. The objective is to map where the boundary actually holds, where it has documented gaps, and which artifacts each behavior leaves behind for detection.

environment

Instrumented Windows 11 host used as the test environment — no virtualization layer
Sysinternals suite (System Informer, Procmon, Autoruns) plus Windows eventing/Sysmon for telemetry on-target
Persistent-state analysis — the host accumulates real artifacts across runs, which is part of what makes the telemetry interesting

architecture / design

The environment is deliberately simple: an instrumented Windows host where artifacts execute while Sysinternals and Windows eventing capture the resulting telemetry. Captures are compared across runs to separate normal platform noise from test-induced artifacts.

technical implementation

Enumeration of auto-elevated binaries and COM interfaces exposed across the UAC boundary
Reproduction of documented boundary behaviors under controlled conditions
Artifact capture per test: event logs, process creation telemetry, registry and filesystem traces
Correlation of observed artifacts against expected detection surface

security considerations / methodology

Testing is limited to documented, publicly described techniques — the work is understanding and validating boundaries, not developing novel exploits
All testing happens inside the isolated lab; nothing touches production systems or third parties
Baseline validation with benign artifacts (EICAR-class test files) before any technique testing — if the sensor can't see a test file, it won't see anything else

interesting problems encountered

Separating technique-specific artifacts from baseline system noise in event telemetry
Determining which boundary behaviors are version-dependent versus consistent across builds

what i built

Repeatable test procedures for each boundary behavior under study
A structured research log mapping techniques to their observable artifacts
Detection notes per technique — what a defender can see and where the gaps are

results

Documented boundary behaviors with their artifact and detection surface.

evidence

System Informer process tree — three persistent malware processes identified in telemetry

$ process telemetry — three persistent infections identified: rundll32.exe running as NT AUTHORITY\SYSTEM, agent.exe, and WerFault.exe spawned by LogiOptions.exe after it waited out the sandbox

Lab topology — instrumented test VM, telemetry collection, analysis host

$ lab topology — test vm feeds telemetry into collection; analysis happens on a separate host over an internal-only segment

Source code and raw research artifacts stay private. This writeup documents the work without exposing the underlying tooling, targets, or findings detail.

what i learned / next steps

Deeper familiarity with Windows internals than documentation alone provides — and a practical sense of what defenders can and cannot observe. Next: expanding coverage to additional boundary mechanisms and formalizing the detection notes into something publishable.