21/09/2025
🖥️ Windows Commands for Cybersecurity — Quick Cheat Sheet 🛡️
Short description: A compact, practical reference of Windows commands and PowerShell cmdlets that cybersecurity pros use for triage, investigation, and hardening. Use these in labs or on systems you manage. 🧰🔍
🧾 System & Host Info
View basic host details and environment quickly: systeminfo (OS & patch info), hostname (machine name), whoami (current user). For detailed Windows config, use PowerShell: Get-ComputerInfo. ✅🖥️
🌐 Network & Connectivity
Check network state and connections with ipconfig /all, test reachability with ping , show route with tracert , and list sockets with netstat -ano. In PowerShell: Get-NetIPAddress, Get-NetRoute, Test-NetConnection. 📡🔗
👤 Accounts, Permissions & Auth
Audit users and groups with net user and net localgroup. See current sessions with quser and active logons via whoami /all. PowerShell IAM commands: Get-LocalUser, Get-LocalGroupMember. Review RDP sessions and privileged accounts often. 🔐👥
🔎 Logs, Forensics & Eventing
Query Windows Event Logs with wevtutil qe Security /q:"*[System[(EventID=4625)]]" or use PowerShell: Get-WinEvent -LogName Security -MaxEvents 100. For kernel & boot logs: journalctl is Linux — on Windows, wevtutil/Get-EventLog and Get-WinEvent are your friends. 🧩📜
⚙️ Processes, Services & Persistence
List processes: tasklist or Get-Process. Kill a PID: taskkill /PID /F. Manage services: sc query / sc stop or PowerShell Get-Service / Stop-Service. Inspect autoruns with Sysinternals Autoruns.exe. ⚙️🛠️
💽 Disk, Files & Hashing
Check disks: chkdsk, partition info via diskpart (use carefully). Compute file hashes: certutil -hashfile file.exe SHA256. Search files: PowerShell Get-ChildItem -Recurse -Filter *.log. 🗂️🔐
🛡️ Security & Hardening
Check firewall rules: netsh advfirewall firewall show rule name=all or PowerShell Get-NetFirewallRule. Audit installed updates: wmic qfe list or Get-HotFix. Manage Windows Defender: MpCmdRun.exe or PowerShell Get-MpComputerStatus. 🔒⚡
🤖 Automation & Advanced PowerShell
Use PowerShell for complex hunts: `Get-EventLog -LogName Security | Where-Object
