Lion Cipher Lab
Your first PowerShell for defenders: inspect a Windows host
- Cyber / Security Engineer
- Beginner
- ~40 min
- Free · no account required
Why it matters
PowerShell is the language defenders use to interrogate Windows. When an analyst sits down at a Windows host that's behaving strangely, the very first moves are almost always the same three questions: what processes are running, what is this machine talking to on the network, and who has logged in? PowerShell answers all three in seconds, read-only, without extra tooling. The exact cmdlets you'll run here — Get-Process, Get-Service, Get-NetTCPConnection, Get-WinEvent — are the ones a real triage of a suspected-compromised Windows box starts with. Learn them once on your own machine and you…
What you'll learn
- PowerShell basics
- verb-noun cmdlets
- listing processes and services
- reading active network connections
- reading the Windows event log
- triaging a Windows host
Steps in this lab
- Open PowerShell and learn how its commands are named
- What's running? (Get-Process)
- What's installed to run in the background? (Get-Service)
- What's talking to the network? (Get-NetTCPConnection)
- Who logged in? (Get-WinEvent, and the classic Get-EventLog)
- You just did the opening move of Windows triage