Skip to main content

Situational Awareness

Network

CommandsExampleDescriptionLinks
PowerShell
Get-NetIPAddressGet-NetIPAddressRetrieves IP address configuration.https://learn.microsoft.com/en-us/powershell/module/nettcpip/get-netipaddress
Set-NetIPAddressSet-NetIPAddress -InterfaceIndex 12 -IPAddress 192.168.0.2Modifies IP address settings on a network interface.https://learn.microsoft.com/en-us/powershell/module/nettcpip/set-netipaddress
Test-NetConnectionTest-NetConnection www.google.comDisplays diagnostic information for a connection.https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection
Get-NetAdapterGet-NetAdapterGets a list of network adapters on a computer.https://learn.microsoft.com/en-us/powershell/module/netadapter/get-netadapter
Batch
ipconfigipconfig /allDisplays all current TCP/IP network configuration values.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig
pingping www.google.comSends ICMP Echo Request messages to a specified host to test IP-level connectivity.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ping
tracerttracert www.google.comDetermines the path to a destination by sending ICMP Echo Request messages.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tracert
netstatnetstat -anoDisplays active TCP connections and ports on which the computer is listening.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat
pathpingpathping www.google.comProvides information about network latency and network loss at intermediate hops between a source and destination.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/pathping
routeroute printDisplays and modifies the IP routing table.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/route
arparp -aDisplays and modifies the IP-to-Physical address translation tables used by address resolution protocol (ARP).https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/arp

Windows Defender and AppLocker

CommandsExampleDescriptionLinks
Windows Defender
Get-MpPreferenceGet-MpPreferenceRetrieves preferences for Windows Defender scans and updates.https://learn.microsoft.com/en-us/powershell/module/defender/get-mppreference
Set-MpPreferenceSet-MpPreference -DisableRealtimeMonitoring $falseModifies settings for Windows Defender.https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference
Start-MpScanStart-MpScan -ScanType QuickScanStarts a Windows Defender scan on a machine.https://learn.microsoft.com/en-us/powershell/module/defender/start-mpscan
Update-MpSignatureUpdate-MpSignatureUpdates the Windows Defender malware definitions.https://learn.microsoft.com/en-us/powershell/module/defender/update-mpsignature
AppLocker
Get-AppLockerPolicyGet-AppLockerPolicy -LocalRetrieves the AppLocker policy for the local computer or a specified Group Policy Object (GPO).https://learn.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy
Set-AppLockerPolicySet-AppLockerPolicy -XMLPolicy "C:\path\to\policy.xml"Sets the AppLocker policy for the local computer or a specified GPO.https://learn.microsoft.com/en-us/powershell/module/applocker/set-applockerpolicy
Test-AppLockerPolicyTest-AppLockerPolicy -Path "C:\path\to\exe" -User EveryoneDetermines whether any AppLocker rules in a policy would block a file from running.https://learn.microsoft.com/en-us/powershell/module/applocker/test-applockerpolicy

Processes Management and Monitoring

CommandsExampleDescriptionLinks
PowerShell
Get-ProcessGet-Process -Name chromeRetrieves information about the processes running on the local computer or a remote computer.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process
Start-ProcessStart-Process notepad.exeStarts one or more processes on the local computer.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process
Stop-ProcessStop-Process -Name notepadStops one or more running processes.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-process
Batch
tasklisttasklistDisplays a list of currently running processes on the local computer or on a remote computer.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist
startstart notepad.exeStarts a separate window to run a specified program or command.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
taskkilltaskkill /IM notepad.exeEnds one or more tasks or processes.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/taskkill

Environment Variables

CommandsExampleDescriptionLinks
PowerShell
Get-ChildItem Env:Get-ChildItem Env:Retrieves all environment variables.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-childitem
$Env:VariableName$Env:PATHRetrieves the value of a specific environment variable.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_environment_variables
Set-ItemSet-Item -Path Env:JAVA_HOME -Value "C:\Java\"Sets the value of an environment variable for the current session.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-item
[System.Environment]::SetEnvironmentVariable[System.Environment]::SetEnvironmentVariable("JAVA_HOME", "C:\Java\", [System.EnvironmentVariableTarget]::Machine)Sets the value of an environment variable persistently (for current user or machine).https://learn.microsoft.com/en-us/dotnet/api/system.environment.setenvironmentvariable
Batch
setset PATHDisplays, sets, or removes environment variables.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
echo %VariableName%echo %PATH%Displays the value of a specific environment variable.https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-xp/bb490880(v=technet.10)
setxsetx JAVA_HOME "C:\Java\"Creates or modifies environment variables in the user or system environment.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/setx

Patches

CommandsExampleDescriptionLinks
PowerShell
Get-HotFixGet-HotFixRetrieves information about hotfixes and patches installed on the system.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-hotfix
Install-WindowsUpdate (PSWindowsUpdate Module)Install-WindowsUpdate -AcceptAll -AutoRebootInstalls available Windows updates (requires the PSWindowsUpdate module).https://www.powershellgallery.com/packages/PSWindowsUpdate
Get-WindowsUpdate (PSWindowsUpdate Module)Get-WindowsUpdateDisplays available Windows updates (requires the PSWindowsUpdate module).https://www.powershellgallery.com/packages/PSWindowsUpdate
Add-WUServiceManager (PSWindowsUpdate Module)Add-WUServiceManager -ServiceID 7971f918-a847-4430-9279-4a52d1efe18dRegisters a Windows Update service manager (required for accessing updates through the PSWindowsUpdate module).https://www.powershellgallery.com/packages/PSWindowsUpdate
Remove-WindowsUpdate (PSWindowsUpdate Module)Remove-WindowsUpdate -KBArticleID KB1234567Uninstalls a specific Windows update (requires the PSWindowsUpdate module).https://www.powershellgallery.com/packages/PSWindowsUpdate
Batch
systeminfosysteminfo
wmic qfewmic qfe

Installed Programs

CommandsExampleDescriptionLinks
PowerShell
Get-ItemPropertyGet-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall*Retrieves information about installed programs from the registry.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-itemproperty
Get-WmiObjectGet-WmiObject -Class Win32_ProductRetrieves detailed information about installed programs using Windows Management Instrumentation (WMI).https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject
Batch
wmic productwmic product get name,versionLists installed programs with their names and versions using Windows Management Instrumentation Command-line (WMIC).https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmic

Users and Groups

CommandsExampleDescriptionLinks
PowerShell
Get-LocalUserGet-LocalUserRetrieves all local user accounts.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/get-localuser
New-LocalUserNew-LocalUser -Name "User1"Creates a new local user account.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/new-localuser
Add-LocalGroupMemberAdd-LocalGroupMember -Group "Administrators" -Member "User1"Adds a user to a local group.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/add-localgroupmember
Get-LocalGroupGet-LocalGroupRetrieves all local groups.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/get-localgroup
Batch
net usernet user usernameDisplays or modifies user accounts on the computer.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-user
net localgroupnet localgroup "Administrators"Adds, displays, or modifies local groups.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-localgroup
net accountsnet accountsDisplays or sets the password and logon requirements for users.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-accounts
whoamiwhoamiDisplays the user name and groups that you are currently working as.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
whoami /privwhoami /privDisplays the security privileges of the current user.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
whoami /groups
queryquery userDisplays information about user sessions on a terminal server.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/query

Named Pipes

CommandsExampleDescriptionLinks
PowerShell
New-Object System.IO.Pipes.NamedPipeServerStream$pipe = New-Object System.IO.Pipes.NamedPipeServerStream("MyPipe")Creates a new instance of a named pipe server.https://learn.microsoft.com/en-us/dotnet/api/system.io.pipes.namedpipeserverstream
New-Object System.IO.Pipes.NamedPipeClientStream$pipe = New-Object System.IO.Pipes.NamedPipeClientStream("MyPipe")Creates a new instance of a named pipe client.https://learn.microsoft.com/en-us/dotnet/api/system.io.pipes.namedpipeclientstream
Get-ChildItem \.\pipe\ Get-ChildItem \.\pipe\ Lists all named pipes on the local machine.https://docs.microsoft.com/en-us/powershell/ (specific documentation for this usage is not available, but it is a common PowerShell technique)
Batch
\.\pipe\ dir \.\pipe\ Accesses the named pipe file system, typically used for listing available pipes.No direct documentation, but referenced in https://support.microsoft.com/topic/named-pipe-client-and-server-use-in-a-windows-environment-7e7e2b9d-2b1e-8bf1-52dc-7b8d99f7a2cc
pipelistpipelistDisplays a list of all named pipes on the local machine.https://learn.microsoft.com/en-us/sysinternals/downloads/pipelist

Security Permissions

CommandsExampleDescriptionLinks
PowerShell
Get-AclGet-Acl C:\path\to\file.txtGets the access control list (ACL) for a file or directory.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl
Set-AclSet-Acl -Path C:\path\to\file.txt -AclObject $aclSets the ACL for a file or directory.https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl
Batch
caclscacls C:\path\to\file.txtDisplays or modifies access control lists (ACLs) of files.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/cacls
icaclsicacls C:\path\to\file.txtDisplays or modifies discretionary access control lists (DACLs) on specified files.https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
accesschkaccesschk -uwcqv User *Displays the accesses that a user or group has to resources.https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk