Linux Philosophy & File System Structure: Understanding the open-source "everything is a file" model, interacting with the Virtual File System (VFS), and mapping directory hierarchies from configuration bases to binary files.
Linux Command Line (Bash Operations): Executing commands, utilizing standard input (stdin), standard output (stdout), standard error (stderr), and piping commands together to construct administrative pipelines.
Linux Permissions & Access Controls: Managing system security profiles using traditional owner-group-other permissions, utilizing SUID/SGID execution bits, applying granular Access Control Lists (ACLs), and navigating the high-privilege root user context.
Linux Daemons, Services & Initialization (Systemd vs. SysVinit): Managing persistent background operations, troubleshooting startup flows, and configuring runlevels or target states to control system services.
Linux Package Management & Compilation: Installing, updating, and verifying software packages across popular Linux distributions, as well as manually compiling raw source code into executable binaries.
Windows Architecture (NT Kernel, HAL, NTFS, Alternate Data Streams): Examining the proprietary Windows operating system layer, the Hardware Abstraction Layer (HAL), and the NTFS file system, including hidden data storage via Alternate Data Streams (ADS).
The Windows Registry (Hives, Keys, Values): Navigating the centralized hierarchical database that stores configuration parameters for the system kernel, user profiles, and applications, with a focus on keys commonly targeted for malware persistence.
Active Directory (AD) Architecture: Mapping enterprise identity structures, including domain hierarchies, forest configurations, physical domain controller systems, and Flexible Single Master Operation (FSMO) roles.
Windows Group Policy Objects (GPO): Enforcing centralized configuration changes, system access controls, and security policies across domains, including rule inheritance and precedence mechanics.
Windows Authentication (Kerberos vs. NTLMv2): Analyzing how identity is proven in enterprise networks, comparing ticketing protocols and ticket granting services (Kerberos) with legacy cryptographic challenge-response authentication.
Windows API & Internals (DLLs, Processes, Threads, Handles): Understanding how software interacts with the OS kernel using Dynamic Link Libraries, processes, execution threads, and hardware handles.
Windows Sysinternals Suite: Leveraging advanced administrative diagnostic tools (such as Process Explorer, Autoruns, and Process Monitor) to audit, trace, and troubleshoot system and application behavior.
Mainframe Architecture (IBM z/OS & LPARs): Interacting with legacy enterprise mainframe systems, running system processes, and managing virtual hardware boundaries through Logical Partitions (LPARs).
Mainframe Security (RACF): Auditing and configuring legacy access paths and user role definitions using the Resource Access Control Facility on IBM mainframes.