Glossary
Plain-language definitions of the Windows security features and attack techniques used across the guides.
A
- Active Directory tier model
- An administrative model that separates Tier 0 (identity), Tier 1 (servers) and Tier 2 (workstations) so privileged credentials are never exposed on less trusted systems.
- AMSI (Antimalware Scan Interface)
- A Windows interface that lets scripting engines and applications send content to the installed antimalware product for scanning before it runs.
- App Control for Business (WDAC)
- Windows' kernel-enforced application allowlisting, formerly Windows Defender Application Control: only drivers and code allowed by policy can run.
- AppLocker
- Windows application control feature that allows or denies executables, scripts, installers, DLLs and packaged apps per user or group.
- Attack surface reduction (ASR) rules
- Microsoft Defender Antivirus behaviour rules that block common malware techniques, such as Office spawning processes or reading LSASS, regardless of file signatures.
C
- Constrained Language Mode
- A PowerShell language mode that blocks arbitrary .NET, COM and Win32 API access, enforced automatically by App Control or AppLocker script policies.
- Controlled folder access
- A Microsoft Defender Antivirus feature that stops untrusted applications from modifying files in protected folders, limiting ransomware damage.
- Credential Guard
- A Windows feature that uses virtualization-based security to isolate NTLM hashes and Kerberos secrets from LSASS, defeating most credential dumping.
E
- Exploit protection
- Built-in Windows memory and process mitigations, such as DEP, ASLR and CFG, applied system-wide or per application and managed with policy.
J
- Just Enough Administration (JEA)
- A PowerShell remoting feature that gives users only specific administrative commands on a server, through temporary virtual accounts.
K
- Kernel DMA Protection
- A Windows feature that uses the IOMMU to block external Thunderbolt and PCIe devices from direct memory access until they are trusted.
L
- LLMNR and NBT-NS poisoning
- An attack where a host on the local network answers broadcast name lookups to capture NetNTLM authentication from Windows clients.
- LSA protection (RunAsPPL)
- Runs LSASS as a protected process light so that even administrators cannot read its memory or inject unsigned code into it.
M
- Memory integrity (HVCI)
- Hypervisor-protected code integrity: a VBS feature that validates kernel-mode code in an isolated environment so unsigned drivers cannot run.
- Microsoft Defender SmartScreen
- A reputation service in Windows and Microsoft Edge that warns about or blocks phishing sites, malicious downloads and unknown applications.
N
- NTLM relay
- An attack that forwards a victim's NTLM authentication to another server in real time, authenticating as the victim without knowing the password.
P
- Point and Print
- A Windows printing feature that lets users connect to a shared printer and automatically download its driver from the print server.
- Protected Users group
- A built-in Active Directory group whose members get non-configurable protections: no NTLM, no delegation, no cached credentials and short Kerberos TGTs.
R
- Remote Credential Guard
- An RDP mode that redirects Kerberos requests back to the client, so the user's credentials are never sent to or stored on the remote host.
S
- Secure Boot
- A UEFI feature that only lets firmware load boot components signed by trusted keys, protecting the Windows boot path from bootkits.
- SMB signing
- Cryptographic signing of SMB packets that prevents tampering and blocks NTLM relay to SMB servers.
- Sysmon
- Microsoft Sysinternals System Monitor: a free driver and service that logs detailed process, network, file, registry and DNS activity to the Windows event log.
T
- Tamper protection
- A Microsoft Defender setting that prevents local changes to key antivirus settings, even by administrators, so attackers cannot simply switch it off.
- Trusted Platform Module (TPM)
- A hardware security chip that generates and protects keys, records boot measurements and anchors BitLocker, Windows Hello and attestation.
V
- Vulnerable driver blocklist
- A Microsoft-maintained list of signed but exploitable kernel drivers that Windows refuses to load, blocking bring-your-own-vulnerable-driver attacks.
W
- WDigest
- A legacy Windows authentication package that, when enabled, keeps plaintext passwords in LSASS memory where credential dumping tools can read them.
- Windows Event Forwarding (WEF)
- A built-in Windows feature that pushes selected event log entries from many computers to a central collector over WinRM, with no agent.
- Windows Hello for Business
- A passwordless sign-in method that replaces passwords with a device-bound, TPM-protected key unlocked by a PIN or biometric gesture.
- Windows LAPS
- Windows Local Administrator Password Solution: a built-in feature that gives each device a unique, rotating local admin password stored in AD or Entra ID.