Archive Margins

Field Notes

Loose observations, compatibility oddities, and the durable fragments that don’t fit anywhere smaller.

Cross-cutting notes, defensive observations, and operational fragments that tie the archive together.

Notes23

Latest Update2026-05-06

Route/research/categories/field-notes

appcompatshimpowershellcommand-execution

Category Index

All research filed under this constellation.

Latest notes appear first so the category stays useful as a focused, living archive rather than a dead taxonomy page.

Field Notes

2026-05-06

other

Why Does MsMpEng Spawn svchost.exe Without Flags?

An RE deep dive at why Microsoft Defender can create an svchost.exe process without the usual service-host command-line flags.

ConstellationField Notes · other

windowswindows-internalsdefender

Read note

Field Notes

2026-05-01

other

DismHost - Command-Line, COM Registration, and DLL Loading

Notes from reversing DismHost.exe, the out-of-process COM host used by DISM image sessions.

ConstellationField Notes · other

windowsdismcom

Read note

Field Notes

2026-03-25

other

Calc Vs Win32Calc Vs CalculatorApp

An exploration of the `calc.exe` binary, its relationship with `Win32Calc.exe` and `CalculatorApp.exe`, and how it serves as a launcher for the modern Calculator app on Windows.

ConstellationField Notes · other

windowspackaged-appsuwp

Read note

Field Notes

2026-03-25

other

PowerShell COM Object Execution - A List of Commonly Abused COM Objects

A list of commonly abused COM objects that can be instantiated and manipulated using PowerShell for malicious purposes, along with examples of how they can be used in attack scenarios.

ConstellationField Notes · other

windowspowershellcommand-execution

Read note

Field Notes

2025-12-08

other

React/Next.js Detection Notes

Notes on the behavior of React / Next.js when spawning child processes, particularly in development and production modes with a focus on how the Node.js `child_process` functions would look like from a process tree perspective, and was inspired by the React2Shell vulnerability.

ConstellationField Notes · other

windowsdetection-engineeringreact

Read note

Field Notes

2025-07-01

other

Windows Security Logs Generated At Boot - An Overview

An overview of the security logs generated at boot time on a Windows machine, even when no audit policy is configured. This includes a summary of the events and their details, particularly focusing on Event ID 4688 which logs process creation events.

ConstellationField Notes · other

windowsevent-logsboot

Read note

Field Notes

2024-01-23

other

Shim Database XML Format

Reverse engineering the XML format used to construct SHIM databases (.sdb) using `shimdbc`, based on analysis of the `fixApp.exe` binary and the leaked WindowsXP source code schema. This writeup includes definitions for various XML elements such as QUIRK, FLAG, KDriver, KDevice, ReinstallUpgrade, Migration, Xap, and Patch, along with their attributes and defined constants.

ConstellationField Notes · other

windowsappcompatshim

Read note

Field Notes

2024-01-23

other

Tracking Parent/Child Process Relationship Via BAM Registry Key

Exploring how to track parent/child process relationships indirectly by monitoring registry set events for the BAM registry key.

ConstellationField Notes · other

windowsregistrybam

Read note

Field Notes

2024-01-23

other

Windows Compatibility QUIRKS

Researching the concept of compatibility QUIRKS in Windows, how they are defined, how they work and how to find them.

ConstellationField Notes · other

windowsappcompatquirks

Read note

Field Notes

2024-01-09

other

LibZ Inject-Dll Artefact

An exploration of the artefact created by the LibZ library when using the Inject-DLL feature, which results in temporary files being generated in the %temp% directory. This writeup delves into the reasons behind this behavior, how the artefact is generated, and the underlying mechanisms at play.

ConstellationField Notes · other

windowsdotnet

Read note

Field Notes

2024-01-05

other

DismHost Temporary Directory Explained

An exploration of the temporary directory created by DismHost.exe when DISM is run in sandbox mode, including how to enforce this mode and monitor its behavior through DISM logs.

ConstellationField Notes · other

windowsdism

Read note

Field Notes

2024-01-05

other

List Of Built-in & Third Party Applications Calling RegisterApplicationRestart API

Details on built-in and third party applications that call the `RegisterApplicationRestart` API to automatically restart in case of a crash, update, computer shutdown or computer restart. This writeup includes a list of applications and their respective command line options used for restarting.

ConstellationField Notes · other

windowsapp-restart

Read note

Field Notes

2024-01-04

other

Another Way For Finding ShimDBC

Deep dive into an alternative method for locating the ShimDBC utility, which is used for compiling application compatibility fixes (shims) into .sdb files. This method involves leveraging the Standard User Analyzer (SUA) tool included in the Application Compatibility Toolkit (ACT) to generate .sdb files from XML definitions without needing to patch Compatadmin.exe.

ConstellationField Notes · other

windowsappcompatshim

Read note

Field Notes

2024-01-02

other

Compatibility Application Layers (Shims) Documentation

A comprehensive list of documented application compatibility layers (shims) as extracted from the Microsoft Application Compatibility Database (Compatadmin.exe) and sysmain.sdb, along with their associated flags and shims used for compatibility purposes.

ConstellationField Notes · other

windowsappcompatshim

Read note

Field Notes

2024-01-02

other

Persistence Via RegisterAppRestart Shim

Detailed writeup on the `RegisterAppRestart` SHIM, how it can be used to achieve persistence by registering an application for restart after a crash or reboot, and how to leverage built-in application fixes to apply this SHIM without modifying the registry.

ConstellationField Notes · other

windowsappcompatshim

Read note

Field Notes

2023-12-31

other

Undocumented CLI Flags - Sdbinst.EXE

Exploring the undocumented CLI flags of the `sdbinst.exe` utility, including their functionality and potential use cases.

ConstellationField Notes · other

windowsappcompatshim

Read note

Field Notes

2023-12-27

other

Living Of The SHIMS - Built-In SHIM DB Hijacking

Details on the built-in SHIM database `sysmain.sdb` that Windows uses to store compatibility fixes or shims. This writeup explores the content of the database, how it can be hijacked, and a list of binaries with interesting shims that could be potentially hijacked.

ConstellationField Notes · other

windowsappcompatshim

Read note

Field Notes

2023-12-23

other

32Bit Application Shim Fixes

A comprehensive list of documented application compatibility fixes (shims) for 32-bit applications, as extracted from the Microsoft Application Compatibility Database (Compatadmin.exe), along with their associated flags and descriptions of their functionality.

ConstellationField Notes · other

windowsappcompatshim

Read note

Field Notes

2023-12-23

other

UWP / Packaged Desktop Application Startup Persistence

Detailed writeup on how UWP and Packaged desktop applications can create startup tasks to execute at startup, where the information about these tasks is stored, and how to enumerate them.

ConstellationField Notes · other

windowspersistencepackaged-apps

Read note

Field Notes

2023-11-18

other

Notepad History / TabState Location

Quick writeup on the location of the notepad history / tabstate files, which are .bin files located in the notepad package folder. These files are used by notepad to save the history of opened tabs and their state when notepad is closed.

ConstellationField Notes · other

windowsnotepad

Read note

Field Notes

2023-04-22

other

PowerShell Default Aliases

Exploring the built-in PowerShell aliases available in PowerShell 5 and PowerShell 7, including some of the changes and additions introduced in PowerShell 7.

ConstellationField Notes · other

windowspowershell

Read note

Field Notes

2023-04-15

other

Invoke-CommandInDesktopPackage Interesting Tidbit

An interesting tidbit about the Invoke-CommandInDesktopPackage PowerShell cmdlet, which allows you to execute commands in the context of an AppX Package, providing access to virtualized resources such as registry keys and files. This can be particularly useful for gaining insights into the behavior of AppX packages and their interactions with the system.

ConstellationField Notes · other

windowspowershellregistry

Read note

Field Notes

2023-04-15

other

PowerShell Suspicious Keywords List

A comprehensive list of suspicious keywords in PowerShell that trigger an automatic 4104 event with Level 3 (Warning) when found in a script block, regardless of logging policy. This list is based on the source code of PowerShell and includes various functions, methods, and APIs that are commonly associated with potentially malicious activities.

ConstellationField Notes · other

windowspowershellscript-block-logging

Read note