Windows-platform primitives (win/*)

← maldev README · docs/index

The win/* package tree is Layer 1: low-level Windows primitives every higher-layer technique builds on. There is no single "win technique" — the area is a foundation for the others.

flowchart TB
    subgraph imports [Imports & syscalls]
        API[win/api<br>PEB walk + ROR13 hash]
        NTAPI[win/ntapi<br>typed Nt* wrappers]
        SYSCALL[win/syscall<br>Direct/Indirect SSN]
    end
    subgraph identity [Token & identity]
        TOK[win/token<br>steal · privileges · UBR]
        IMP[win/impersonate<br>thread context swap]
        PRIV[win/privilege<br>IsAdmin · ExecAs]
    end
    subgraph fingerprint [Host fingerprint]
        VER[win/version<br>RtlGetVersion + UBR]
        DOM[win/domain<br>NetGetJoinInformation]
    end
    API --> NTAPI
    API --> SYSCALL
    TOK --> IMP
    IMP --> PRIV
    VER --> GATE{technique<br>compatibility}
    DOM --> GATE

Decision tree

Operator questionPackagePages
"Resolve a Windows API without a string in my binary."win/apiapi-hashing
"Call NtXxx through ntdll (skip kernel32 hooks)."win/ntapisyscalls/README
"Call NtXxx skipping ALL userland hooks."win/syscalldirect-indirect, ssn-resolvers
"Steal a token from PID X."win/tokentoken-theft
"Run a callback as user@domain / SYSTEM / TI."win/impersonateimpersonation
"Am I admin / elevated right now? Spawn as a different user?"win/privilegeprivilege-escalation
"What Windows build am I on? Is it patched for CVE-X?"win/versionversion
"Is this host workgroup or AD-joined?"win/domaindomain

Per-package pages

Pages owned by this directory:

  • domain.md — NetGetJoinInformation host fingerprint.
  • version.md — RtlGetVersion + UBR + CVE-state probe.

Pages owned by sibling directories:

MITRE ATT&CK rollup

IDTechniqueOwners
T1106Native APIwin/api, win/ntapi, win/syscall
T1027Obfuscated Files or Informationwin/api (hash imports)
T1027.007Dynamic API Resolutionwin/api, win/syscall (gates)
T1134Access Token Manipulationwin/token, win/impersonate, win/privilege
T1134.001Token Impersonation/Theftwin/token, win/impersonate
T1134.002Create Process with Tokenwin/privilege
T1078Valid Accountswin/privilege (alt-creds spawn)
T1082System Information Discoverywin/version, win/domain
T1016System Network Configuration Discoverywin/domain (paired with recon/network)

See also