Windows carries 30 years of legacy code running at SYSTEM privilege, written before modern threat models existed. This guide maps the attack surface nobody audits — COM, Win32k, the Registry, named pipes — and the methodology for finding what's been hiding there since 1996.