%Schriftgröße, Layout, Papierformat, Art des Dokumentes
\documentclass[10pt,oneside,a4paper]{scrartcl}

%Einstellungen der Seitenränder
\usepackage[left=2cm,right=2cm,top=1.5cm,bottom=1.5cm,includeheadfoot]{geometry}

%neue Rechtschreibung
\usepackage[ngerman]{babel}

%Umlaute ermöglichen
\usepackage[utf8]{inputenc}

%Gesamtseitenzahl
\usepackage{lastpage}

% Kopf- und Fußzeile
\usepackage[automark]{scrpage2}

%Quellcode-Listings
\usepackage{listings}

%Hyperlinks
\usepackage{hyperref}

%Kopfzeile
\ihead{CISCO CyberOps Associate (CA) v1.0}
\chead{}
\ohead{http://kohnlehome.de/netz/cyberops-03.pdf}
\setheadsepline{0.5pt}

%Fußzeile
\setfootsepline{0.5pt}
\ifoot{Franz Kohnle}
\cfoot{Seite \thepage\ von  \pageref{LastPage}}
\ofoot{\today}

\pagestyle{scrheadings}

\begin{document}

% Überschrift 
\begin{center}
\LARGE % Schriftgröße
\bfseries % Fettdruck
\sffamily % Serifenlose Schrift
CyberOps Modul 3: The Windows Operating System
\end{center}

\section*{3.1 Windows History}
\begin{itemize}
    \item DOS (Disk Operating System), MS-DOS
    \item NT (New Technologies)
    \item cmd-commands: \texttt{dir, cd, copy, del, find, mkdir, ren, help}
    \item Windows Versions: 7, Server 2008 R2, 8, Server 2012, 8.1, Server 2012 R2, 10, Server 2016
    \item Windows GUI: Desktop, Task Bar
    \item Operating System Vulnerabilities: Virus, malware, Windows Defender, unknown services, encryption, security policy, firewall, weak password, login as administrator
\end{itemize}

\section*{3.2 Windows Architecture and Operations}
\begin{itemize}
    \item Hardware Abstraction Layer (HAL), Kernel
    \item User Mode (driver crash $\rightarrow$ system crash), Kernel Mode (own restricted address space)
    \item Windows File Systems: exFAT, HFS+ (Mac OSX), ext (Linux), NTFS (Partition boot sector, Master file table, system files, file area)
    \item Alternate Data Streams: filename.txt:ADS
    \item Windows boot process: BIOS / UEFI $\rightarrow$ Bootmgr.exr $\rightarrow$ BCD $\rightarrow$ Winload.exe (Ntoskrnl.exe) / Winresume.exe (Hiberfil.sys)
    \item Windows Startup: Msconfig.exe
    \item Windows Shutdown: shutdown (ctrl+alt+del), restart, hibernate
    \item Processes, Threads, and Services: Task Manager
    \item Memory Allocation and Handles: RAMMap (sysinternals)
    \item The Windows Registry: HKCU, HKU, HKCR, HKLM, HKCC, regedit.exe (REG\_BINARY, REG\_DWORD, REG\_SZ)
    \item Lab: sysinternals (procexp.exe), regedit.exe 
\end{itemize}

\section*{3.3 Windows Configuration and Monitoring}
\begin{itemize}
    \item Run as Administrator
    \item Local Users and Domains (lusrmgr.msc)
    \item CLI (cmd.exe) and PowerShell
    \item WMI (Windows Management Instrumentation)
    \item The net Command: net accounts, net session, net share, net start, net stop, net use, net view 
    \item Task Manager and Resource Monitor
    \item Networking: Network and Sharing Center, nslookup, netstat
    \item Accessing Network Resources: $\backslash \backslash servername \backslash sharename \backslash file$, RDP (Remote Desktop Connection)
    \item Windows Server: DNS, DHCP, SMB, NFS, DFS, FTP, HTTP, HTTPS, Group Policy, Active Directory
    \item Lab: Create User accounts
    \item Lab: Using Windows PowerShell
    \item Lab: Windows Task Manager
    \item Lab: Monitor and Manage System Resources in Windows
\end{itemize}

\section*{3.4 Windows Security}
\begin{itemize}
    \item The netstat Command
    \item Event Viewer
    \item Windows Update Management
    \item Local Security Policy
    \item Windows Defender
    \item Windows Defender Firewall 
\end{itemize}


\end{document}
