PowerShell Commands Cheat Sheet

Overview

PowerShell is a task automation and configuration management framework built on .NET. This cheat sheet focuses on practical commands for system administration, security operations, networking, and automation.

System Information

Quick commands to inspect system, hardware, and OS details.

Basic system overview

Get-ComputerInfo
systeminfo
Get-WmiObject Win32_ComputerSystem

Hardware inventory

Get-WmiObject Win32_Processor
Get-WmiObject Win32_PhysicalMemory
Get-WmiObject Win32_DiskDrive

Operating system details

Get-WmiObject Win32_OperatingSystem
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

Files & Directories

Navigation, creation, deletion, and movement of files and folders.

Navigation

Get-ChildItem
Set-Location C:\Path

Create / delete

New-Item -ItemType File -Path file.txt
New-Item -ItemType Directory -Path C:\Folder
Remove-Item C:\Folder -Recurse

Copy / move

Copy-Item file.txt C:\Backup\
Move-Item file.txt C:\NewLocation\

Processes & Services

Inspect and control running processes and Windows services.

Processes

Get-Process
Stop-Process -Name notepad
Start-Process notepad.exe

Services

Get-Service
Start-Service Spooler
Stop-Service Spooler
Restart-Service Spooler

Networking

Network configuration, connectivity tests, firewall rules, and listening ports.

IP & configuration

Get-NetIPAddress
Get-NetIPConfiguration
Test-NetConnection google.com

Firewall rules

Get-NetFirewallRule
New-NetFirewallRule -DisplayName "BlockApp" -Direction Outbound -Program "C:\app.exe" -Action Block

Listening ports

Get-NetTCPConnection | Where-Object {$_.State -eq "Listen"}

Security & Forensics

Event logs, hashing, and local user enumeration.

Event logs

Get-EventLog -LogName Security -Newest 50
Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational

File hashing

Get-FileHash file.txt -Algorithm SHA256

Local users

Get-LocalUser
New-LocalUser -Name "test" -Password (Read-Host -AsSecureString)

Package Management

Modules installation and inspection.

Install modules

Install-Module -Name PSReadLine
Install-Module -Name Pester

List installed modules

Get-InstalledModule

Automation & Scripting

Variables, loops, and functions for basic scripting.

Variables

$var = "Hello"
Write-Output $var

Loops

foreach ($i in 1..5) { Write-Output $i }

Functions

function Say-Hello {
    param($name)
    Write-Output "Hello $name"
}

Admin & Tasks

Elevation and scheduled tasks.

Run PowerShell as admin

Start-Process powershell -Verb runAs

Scheduled tasks

Get-ScheduledTask
Register-ScheduledTask -TaskName "Test" -Action (New-ScheduledTaskAction -Execute "notepad.exe")

Usage Notes

Many commands require elevated privileges (Run as Administrator). Use this cheat sheet as a base for DFIR workflows, system hardening, and automation scripts.

Search This Blog

Omerta One