03 — PowerShell for Cybersecurity

PowerShell is one of the most important scripting and automation technologies for Windows and Microsoft-focused cybersecurity work.

It gives security professionals direct access to:

WINDOWS

USERS

GROUPS

PROCESSES

SERVICES

EVENT LOGS

REGISTRY

FILESYSTEM

NETWORK CONFIGURATION

ACTIVE DIRECTORY

MICROSOFT CLOUD SERVICES

The key difference between PowerShell and many traditional shells is that PowerShell works primarily with:

OBJECTS

rather than only plain text.

This makes it extremely powerful for:

SECURITY ADMINISTRATION

INCIDENT RESPONSE

SOC OPERATIONS

WINDOWS HARDENING

ACTIVE DIRECTORY REVIEW

SECURITY AUTOMATION

EVIDENCE COLLECTION

PowerShell Learning Path

Follow this sequence:

POWERSHELL SHELL
       ↓
CMDLETS
       ↓
OBJECTS
       ↓
PIPELINE
       ↓
VARIABLES
       ↓
CONDITIONS
       ↓
LOOPS
       ↓
FUNCTIONS
       ↓
FILES
       ↓
PROCESSES
       ↓
SERVICES
       ↓
USERS
       ↓
GROUPS
       ↓
EVENT LOGS
       ↓
REGISTRY
       ↓
NETWORKING
       ↓
ACTIVE DIRECTORY
       ↓
SECURITY AUTOMATION

Why PowerShell Matters in Cybersecurity

Windows remains deeply embedded in enterprise environments.

Cybersecurity professionals regularly need to:

CHECK LOCAL ADMINISTRATORS

REVIEW USER ACCOUNTS

INSPECT SERVICES

ANALYZE EVENT LOGS

REVIEW WINDOWS DEFENDER

CHECK FIREWALL SETTINGS

INSPECT REGISTRY CONFIGURATION

QUERY ACTIVE DIRECTORY

COLLECT INCIDENT EVIDENCE

PowerShell makes these tasks repeatable.

PowerShell Mental Model

The core workflow is:

CMDLET
  ↓
OBJECT
  ↓
PIPELINE
  ↓
FILTER
  ↓
SELECT
  ↓
SORT
  ↓
EXPORT

Example:

GET PROCESSES
      ↓
FILTER
      ↓
SELECT INTERESTING FIELDS
      ↓
EXPORT REPORT

01 — Start PowerShell

Check your PowerShell version:

$PSVersionTable

You may be using:

Windows PowerShell 5.1

or:

PowerShell 7+

Both are useful, but some Windows-specific modules may behave differently.

02 — Understand Cmdlets

PowerShell commands are commonly structured as:

VERB-NOUN

Examples:

Get-Process

Get-Service

Get-ChildItem

Get-LocalUser

This makes command discovery easier.

03 — Discover Commands

Use:

Get-Command

Search for commands related to services:

Get-Command *Service*

Search for event commands:

Get-Command *Event*

04 — Get Help

Use:

Get-Help Get-Process

Detailed:

Get-Help Get-Process -Detailed

Examples:

Get-Help Get-Process -Examples

05 — PowerShell Objects

Run:

Get-Process

The output looks tabular, but each row is an object.

Inspect:

Get-Process |
Get-Member

This shows:

Properties

Methods

Object Type

Why Objects Matter

Instead of manually parsing text, you can directly request properties.

Example:

Get-Process |
Select-Object Name, Id, CPU

06 — The Pipeline

The pipe:

passes objects from one cmdlet to another.

Example:

Get-Process |
Sort-Object CPU -Descending

Then:

Get-Process |
Sort-Object CPU -Descending |
Select-Object -First 10

Pipeline Mental Model

GET DATA
   ↓
FILTER
   ↓
SELECT
   ↓
SORT
   ↓
OUTPUT

07 — Variables

Create:

$userName = "analyst01"

$sourceIP = "10.10.10.25"

$failedLogins = 7

Print:

$userName

or:

Write-Output $userName

08 — Strings

Example:

$message = "Security event detected"

Double quotes expand variables:

Write-Output "User: $userName"

Single quotes do not:

Write-Output 'User: $userName'

09 — Data Types

Common types include:

String

Integer

Boolean

Array

Hashtable

Object

Check:

$userName.GetType()

10 — Arrays

Example:

$hosts = @(
    "WEB01",
    "APP01",
    "DB01"
)

Loop:

foreach ($hostName in $hosts) {
    Write-Output $hostName
}

11 — Hashtables

Example:

$alert = @{
    User = "admin01"
    SourceIP = "10.10.10.25"
    Severity = "High"
}

Access:

$alert["User"]

or:

$alert.User

12 — Conditions

Example:

$failedLogins = 12

if ($failedLogins -gt 10) {
    Write-Output "High-risk authentication activity"
}

13 — if / elseif / else

if ($failedLogins -ge 10) {
    Write-Output "High"
}
elseif ($failedLogins -ge 5) {
    Write-Output "Medium"
}
else {
    Write-Output "Low"
}

14 — Comparison Operators

Common:

-eq     Equal

-ne     Not equal

-gt     Greater than

-lt     Less than

-ge     Greater or equal

-le     Less or equal

-like   Wildcard match

-match  Regex match

15 — Logical Operators

Use:

-and

-or

-not

Example:

if (($failedLogins -gt 10) -and (-not $mfaEnabled)) {
    Write-Output "High-risk condition"
}

16 — Loops

Example:

foreach ($hostName in $hosts) {
    Write-Output "Reviewing $hostName"
}

17 — For Loops

for ($i = 1; $i -le 5; $i++) {
    Write-Output "Iteration $i"
}

18 — While Loops

$count = 1

while ($count -le 3) {
    Write-Output "Run $count"
    $count++
}

19 — Functions

Example:

function Show-SecurityAlert {
    param(
        [string]$Message
    )

    Write-Output "ALERT: $Message"
}

Call:

Show-SecurityAlert -Message "Multiple failed logins"

20 — Function Parameters

Example:

function Get-RiskLevel {
    param(
        [int]$Count
    )

    if ($Count -ge 10) {
        return "High"
    }
    elseif ($Count -ge 5) {
        return "Medium"
    }
    else {
        return "Low"
    }
}

21 — Current Security Context

Run:

whoami

Then:

whoami /all

Review:

Current User

SID

Groups

Privileges

Integrity Level

22 — Identify the Host

Use:

hostname

or:

$env:COMPUTERNAME

23 — System Information

Use:

Get-ComputerInfo

You can select specific fields:

Get-ComputerInfo |
Select-Object WindowsProductName, WindowsVersion, OsArchitecture

24 — Environment Variables

View:

Get-ChildItem Env:

Examples:

USERNAME

COMPUTERNAME

USERDOMAIN

USERPROFILE

PATH

Current directory:

Get-Location

List:

Get-ChildItem

Alias:

ls

Change directory:

Set-Location C:\Windows

Alias:

cd C:\Windows

26 — Create a Security Workspace

New-Item `
    -ItemType Directory `
    -Path C:\Temp\SecurityLab `
    -Force

Create folders:

$folders = @(
    "Evidence",
    "Logs",
    "Reports",
    "Scripts"
)

foreach ($folder in $folders) {
    New-Item `
        -ItemType Directory `
        -Path "C:\Temp\SecurityLab\$folder" `
        -Force |
        Out-Null
}

27 — Read Files

Use:

Get-Content .\security.log

First lines:

Get-Content .\security.log |
Select-Object -First 10

Last lines:

Get-Content .\security.log |
Select-Object -Last 10

28 — Follow a File

Use:

Get-Content .\security.log -Wait

This is useful for monitoring lab logs in real time.

29 — Search File Content

Use:

Select-String `
    -Path .\security.log `
    -Pattern "FAILED"

30 — Recursive Search

Get-ChildItem .\Logs -File -Recurse |
Select-String -Pattern "ERROR"

Use only directories you are authorized to inspect.

31 — Write Files

Use:

"Security analysis started" |
Out-File .\report.txt

Append:

"Suspicious event detected" |
Out-File .\report.txt -Append

32 — CSV

Security products frequently export CSV.

Import:

$events = Import-Csv .\events.csv

View:

$events

33 — Filter CSV Security Data

Example:

$events |
Where-Object Status -eq "Failed"

34 — Export CSV

$events |
Export-Csv .\reports\events.csv -NoTypeInformation

35 — JSON

Convert PowerShell objects to JSON:

$alert = @{
    User = "admin01"
    Severity = "High"
}

$alert |
ConvertTo-Json

36 — Read JSON

$data = Get-Content .\alert.json -Raw |
ConvertFrom-Json

Access:

$data.User

37 — Filtering Objects

Use:

Where-Object

Example:

Get-Service |
Where-Object Status -eq "Running"

38 — Select Properties

Use:

Select-Object

Example:

Get-Service |
Select-Object Name, Status

39 — Sort Results

Get-Process |
Sort-Object CPU -Descending

40 — Group Results

Use:

Group-Object

Example:

Get-Service |
Group-Object Status

41 — Measure Results

Use:

Measure-Object

Example:

Get-Process |
Measure-Object

42 — Processes

List:

Get-Process

Useful fields:

Get-Process |
Select-Object Name, Id, CPU, Path

Some process paths may require additional privileges.

43 — Find a Process

Get-Process -Name powershell

or:

Get-Process |
Where-Object Name -like "*chrome*"

44 — Services

List:

Get-Service

Running services:

Get-Service |
Where-Object Status -eq "Running"

45 — Detailed Service Configuration

Use:

Get-CimInstance Win32_Service |
Select-Object Name, StartName, State, PathName

This is extremely useful for security assessment.

46 — Service Security Questions

For each important service ask:

What Does It Do?

Which Account Runs It?

Where Is Its Executable?

Is It Expected?

Is It Privileged?

Who Can Modify Its Files?

47 — Scheduled Tasks

Use:

Get-ScheduledTask

Select:

Get-ScheduledTask |
Select-Object TaskName, TaskPath, State

48 — Local Users

Use:

Get-LocalUser

Review:

Enabled

Last Logon

Description

Account Expiration

49 — Local Groups

Use:

Get-LocalGroup

50 — Review Administrators

Use:

Get-LocalGroupMember Administrators

This is one of the most useful Windows security checks.

51 — Group Membership Security

Ask:

WHO IS LOCAL ADMIN?

WHY?

IS ACCESS STILL REQUIRED?

IS IT A USER OR GROUP?

IS THE ASSIGNMENT TOO BROAD?

52 — Filesystem Permissions

Use:

Get-Acl C:\Path\To\Resource

Review:

Owner

Access

Identity

Rights

Inheritance

53 — Permission Security Model

Think:

IDENTITY
   ↓
ACL
   ↓
RESOURCE
   ↓
READ / WRITE / MODIFY / FULL CONTROL

54 — Registry Basics

PowerShell exposes the Registry as a provider.

Examples:

Get-ChildItem HKLM:\

Get-ChildItem HKCU:\

55 — Read Registry Values

Example:

Get-ItemProperty `
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion"

56 — Registry Security

Inspect ACLs:

Get-Acl `
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion"

The registry can contain security-relevant configuration.

57 — Network Configuration

Use:

Get-NetIPConfiguration

or:

Get-NetIPAddress

58 — Routes

Use:

Get-NetRoute

59 — DNS Configuration

Use:

Get-DnsClientServerAddress

60 — Network Connections

Use:

Get-NetTCPConnection

Filter listening:

Get-NetTCPConnection |
Where-Object State -eq "Listen"

61 — Map Ports to Processes

Example:

Get-NetTCPConnection -State Listen |
Select-Object LocalAddress, LocalPort, OwningProcess

Then:

Get-Process -Id <PID>

62 — Test Connectivity

For an authorized system:

Test-NetConnection `
    -ComputerName <LAB_HOST> `
    -Port 443

Use only approved destinations.

63 — DNS Lookup

Use:

Resolve-DnsName example.com

or authorized internal lab names.

64 — Event Logs

Windows event logs are extremely important for security operations.

Common logs include:

Security

System

Application

PowerShell

Microsoft Defender

65 — List Event Logs

Use:

Get-WinEvent -ListLog *

66 — Read Security Events

Example:

Get-WinEvent `
    -LogName Security `
    -MaxEvents 20

Access to Security logs may require appropriate privileges.

67 — Filter by Event ID

Example:

Get-WinEvent `
    -FilterHashtable @{
        LogName = "Security"
        Id      = 4625
    } `
    -MaxEvents 20

Event ID:

typically represents failed logon events.

68 — Useful Security Events

Examples:

4624
Successful Logon

4625
Failed Logon

4672
Special Privileges Assigned

4688
Process Creation

4720
User Created

4726
User Deleted

4732
Member Added to Local Group

4740
Account Locked Out

4698
Scheduled Task Created

4702
Scheduled Task Updated

Exact logging depends on system configuration.

Example:

$events = Get-WinEvent `
    -FilterHashtable @{
        LogName = "Security"
        Id      = 4625
    } `
    -MaxEvents 100

Count:

$events.Count

70 — Event Object Inspection

Inspect one:

$events[0] |
Format-List *

This helps you understand available fields before building automation.

71 — Export Event Information

Example:

$events |
Select-Object TimeCreated, Id, MachineName |
Export-Csv `
    .\Reports\failed-logins.csv `
    -NoTypeInformation

72 — Event Analysis Workflow

EVENT LOG
    ↓
GET-WINEVENT
    ↓
FILTER
    ↓
SELECT
    ↓
GROUP
    ↓
EXPORT

73 — PowerShell Operational Logs

Review PowerShell logging where enabled.

Examples may include:

Microsoft-Windows-PowerShell/Operational

List events:

Get-WinEvent `
    -LogName "Microsoft-Windows-PowerShell/Operational" `
    -MaxEvents 20

74 — Windows Defender

Where available:

Get-MpComputerStatus

Review fields such as:

Antivirus Enabled

Real-Time Protection

Signature Status

75 — Defender Security Rule

During normal security assessment:

DO NOT DISABLE DEFENDER

simply to make testing easier.

Assess the security posture without unnecessarily weakening controls.

76 — Windows Firewall

Use:

Get-NetFirewallProfile

Review:

Domain

Private

Public

77 — Firewall Rules

Use:

Get-NetFirewallRule

For focused reviews:

Get-NetFirewallRule |
Where-Object Enabled -eq "True"

78 — Audit Policy

Use:

auditpol /get /category:*

Review areas such as:

Logon

Account Management

Privilege Use

Process Creation

Policy Change

79 — Windows Update Context

Security review may include patch posture.

Use appropriate enterprise tooling where available rather than relying only on ad hoc local commands.

Document:

Patch Governance

Update Service

Last Maintenance

Critical Missing Updates

80 — Active Directory Context

If the host is domain joined:

$env:USERDOMAIN

$env:USERDNSDOMAIN

81 — Discover Domain Controller

Use:

nltest /dsgetdc:<DOMAIN>

where authorized.

82 — Domain Users

Basic:

net user /domain

If the AD module is available:

Get-ADUser -Filter *

83 — Domain Groups

Basic:

net group /domain

With AD module:

Get-ADGroup -Filter *

84 — Domain Admins

Use:

net group "Domain Admins" /domain

This is useful for identifying highly privileged membership.

85 — Active Directory Computers

If available:

Get-ADComputer -Filter * |
Select-Object Name, OperatingSystem

86 — Service Accounts

If AD module is available:

Get-ADUser `
    -Filter {ServicePrincipalName -like "*"} `
    -Properties ServicePrincipalName

Use this for authorized inventory and governance review.

87 — AD Security Mindset

Think:

USER
 ↓
GROUP
 ↓
PERMISSION
 ↓
COMPUTER
 ↓
APPLICATION
 ↓
PRIVILEGE

PowerShell is useful for mapping these relationships.

88 — Group Policy Context

Use:

gpresult /r

This helps identify policies applied to the current user and computer.

89 — Registry and Policy Review

PowerShell allows you to automate configuration checks against approved security baselines.

Example categories:

UAC

Audit Policy

Firewall

Password Policy

Defender

Remote Administration

90 — PowerShell Remoting Concept

PowerShell supports remote administration.

Conceptually:

ADMIN
  ↓
POWERSHELL REMOTING
  ↓
REMOTE WINDOWS HOST

Use remoting only with explicit authorization and approved credentials.

91 — Security Automation Principle

A good automation script should:

COLLECT

VALIDATE

FILTER

NORMALIZE

REPORT

It should not make high-impact changes automatically unless the workflow explicitly requires and approves them.

92 — Build a Windows Security Inventory

Collect:

Hostname

OS

Current User

Local Administrators

Running Services

Listening Ports

Firewall State

Defender State

93 — Example Inventory Structure

$inventory = [PSCustomObject]@{
    ComputerName = $env:COMPUTERNAME
    User         = $env:USERNAME
    Domain       = $env:USERDOMAIN
}

Print:

$inventory

94 — PSCustomObject

This is one of the most useful PowerShell features for reporting.

Example:

$result = [PSCustomObject]@{
    Hostname = $env:COMPUTERNAME
    Finding  = "Firewall Enabled"
    Status   = "Pass"
}

95 — Export Structured Results

$result |
Export-Csv `
    .\Reports\security-check.csv `
    -NoTypeInformation

96 — Build Multiple Results

$results = @()

$results += [PSCustomObject]@{
    Check  = "Firewall"
    Status = "Pass"
}

$results += [PSCustomObject]@{
    Check  = "Defender"
    Status = "Review"
}

97 — Filter Results

$results |
Where-Object Status -eq "Review"

98 — Generate HTML Reports

PowerShell can convert objects:

$results |
ConvertTo-Html |
Out-File .\Reports\report.html

This is useful for simple internal reports.

99 — Error Handling

Use:

try {
    Get-Content .\security.log -ErrorAction Stop
}
catch {
    Write-Output "Unable to read security.log"
}

100 — Why `-ErrorAction Stop` Matters

Some PowerShell errors are non-terminating.

Using:

-ErrorAction Stop

can allow try/catch to handle them consistently.

101 — finally

Example:

try {
    Write-Output "Processing"
}
catch {
    Write-Output "Error"
}
finally {
    Write-Output "Cleanup"
}

Useful when cleanup must always happen.

102 — Script Logging

Example:

function Write-SecurityLog {
    param(
        [string]$Message
    )

    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

    "$timestamp $Message" |
    Out-File `
        .\Reports\script.log `
        -Append
}

103 — Do Not Log Secrets

Avoid writing:

Passwords

Access Tokens

Private Keys

Complete Session Tokens

into script logs.

104 — Script Parameters

Example:

param(
    [string]$ComputerName
)

Run:

.\security-check.ps1 `
    -ComputerName APP01

105 — Validate Parameters

Example:

param(
    [Parameter(Mandatory)]
    [ValidateNotNullOrEmpty()]
    [string]$LogPath
)

PowerShell supports many validation attributes.

106 — Validate Sets

Example:

param(
    [ValidateSet(
        "Low",
        "Medium",
        "High",
        "Critical"
    )]
    [string]$Severity
)

107 — Script Structure

A good PowerShell script may contain:

PARAMETERS

CONFIGURATION

FUNCTIONS

COLLECTION

ANALYSIS

OUTPUT

ERROR HANDLING

CLEANUP

108 — Secure Coding Considerations

Avoid:

Hard-Coded Secrets

Unvalidated Input

Excessive Privilege

Unsafe Dynamic Command Construction

Unnecessary Remote Execution

Sensitive Logging

109 — Avoid Dynamic Code Execution

Treat features such as dynamically evaluating command strings with caution.

Prefer:

NATIVE CMDLETS

PARAMETERS

OBJECT PIPELINES

instead of interpreting untrusted input as executable code.

110 — Least Privilege

Do not automatically launch PowerShell as Administrator.

Ask:

WHICH COMMAND
ACTUALLY REQUIRES
ELEVATED ACCESS?

Run standard-user workflows as a standard user whenever possible.

111 — Execution Policy

View:

Get-ExecutionPolicy

Execution policy is a script-execution safety feature, not a complete security boundary.

Do not weaken policy merely to run unknown code.

112 — Script Signing Concept

In managed environments, scripts may be signed to provide:

AUTHOR VERIFICATION

INTEGRITY

TRUST MANAGEMENT

This can support enterprise automation governance.

113 — PowerShell Transcription

PowerShell can support session transcription in managed environments.

This can help organizations capture:

ADMINISTRATIVE ACTIVITY

SCRIPT EXECUTION

INVESTIGATION CONTEXT

according to organizational policy.

114 — Logging and Monitoring

Organizations should consider:

PowerShell Operational Logs

Script Block Logging

Module Logging

Process Creation

EDR Telemetry

where appropriate.

115 — Project 01: Local Administrator Audit

Create a script that:

GETS HOSTNAME

COLLECTS LOCAL ADMINISTRATORS

IDENTIFIES USERS / GROUPS

EXPORTS CSV

Example base command:

Get-LocalGroupMember Administrators

116 — Project 02: Windows Service Inventory

Collect:

Service Name

State

Startup Type

Service Identity

Executable Path

Use:

Get-CimInstance Win32_Service

Build:

SECURITY LOG
    ↓
EVENT 4625
    ↓
EXTRACT EVENTS
    ↓
COUNT
    ↓
GROUP
    ↓
REPORT

118 — Project 04: Defender Status Report

Collect:

Host

Antivirus State

Real-Time Protection

Signature State

Timestamp

using approved Defender cmdlets.

119 — Project 05: Windows Firewall Audit

Collect:

Profile

Enabled

Default Inbound

Default Outbound

Then export a report.

120 — Project 06: Windows Security Inventory

Combine:

SYSTEM INFO

LOCAL ADMINS

SERVICES

PORTS

FIREWALL

DEFENDER

AUDIT POLICY

into a single security inventory.

121 — Project 07: Event Log Exporter

Allow the analyst to specify:

Log Name

Event ID

Time Range

Maximum Events

Output File

Then export structured evidence.

122 — Project 08: Active Directory Inventory

In an authorized domain lab, collect:

Users

Groups

Computers

Privileged Groups

Service Accounts

and export sanitized reports.

123 — Project 09: File Hash Collection

Use:

Get-FileHash

Example:

Get-FileHash .\sample.txt -Algorithm SHA256

124 — Evidence Hashing

For collected evidence:

Get-FileHash `
    .\Evidence\security.evtx `
    -Algorithm SHA256

Record the hash alongside evidence metadata.

125 — Project 10: Security Configuration Checker

Create checks for:

Firewall

Defender

Local Administrators

Audit Policy

Selected Services

Return:

PASS

REVIEW

FAIL

based on a documented training baseline.

126 — PowerShell for SOC Analysts

Focus on:

Get-WinEvent

Where-Object

Group-Object

Select-Object

Export-Csv

JSON

127 — PowerShell for Incident Responders

Focus on:

Processes

Services

Network Connections

Event Logs

Files

Hashes

Users

Scheduled Tasks

128 — PowerShell for Windows Security Engineers

Focus on:

Users

Groups

Services

Firewall

Defender

Registry

Audit Policy

Configuration Baselines

129 — PowerShell for Active Directory Security

Focus on:

Users

Groups

Computers

Service Accounts

Group Membership

Administrative Relationships

GPO Context

130 — PowerShell for Cloud Security

PowerShell also supports Microsoft cloud ecosystems through dedicated modules.

Common security workflows can include:

IDENTITY INVENTORY

ROLE REVIEW

RESOURCE CONFIGURATION

SECURITY EVENTS

POLICY CHECKS

Use approved modules and authorized environments.

131 — PowerShell vs Bash

A simple mental model:

BASH
=
LINUX + TEXT PIPELINES

POWERSHELL
=
WINDOWS + OBJECT PIPELINES

132 — PowerShell vs Python

Use PowerShell when:

Working Deeply With Windows

Managing Microsoft Services

Querying Windows Objects

Using Native Windows APIs / Modules

Use Python when:

Cross-Platform Automation

Complex Data Processing

General APIs

Larger Security Applications

Often both are useful.

133 — PowerShell Security Principles

Always consider:

WHO RUNS THE SCRIPT?

WHAT PRIVILEGE DOES IT HAVE?

WHAT SYSTEMS DOES IT TOUCH?

WHAT DATA DOES IT READ?

WHAT DATA DOES IT WRITE?

WHAT DOES IT LOG?

WHAT HAPPENS IF IT FAILS?

134 — Never Blindly Run Unknown Scripts

Before executing an unfamiliar script:

READ IT

UNDERSTAND PARAMETERS

CHECK NETWORK CALLS

CHECK FILE OPERATIONS

CHECK REGISTRY OPERATIONS

CHECK PRIVILEGE REQUIREMENTS

CHECK CLEANUP

Do not run unknown scripts as Administrator.

135 — 4-Week PowerShell Practice Plan

Week	Focus
1	Cmdlets, Objects, Pipeline, Variables
2	Files, Processes, Services, Users, Groups
3	Event Logs, Registry, Networking, AD
4	Security Automation Project

PowerShell Readiness Levels

Level 01 — PowerShell Fundamentals

You understand:

Cmdlets

Objects

Pipeline

Variables

Level 02 — Object Processing

You can use:

Where-Object

Select-Object

Sort-Object

Group-Object

Level 03 — Windows Security

You can review:

Users

Groups

Processes

Services

Firewall

Defender

Level 04 — Security Logs

You can:

Query Event Logs

Filter Event IDs

Export Evidence

Summarize Events

Level 05 — Active Directory

You can:

Inventory Users

Review Groups

Inventory Computers

Review Service Accounts

in authorized environments.

Level 06 — Security Automation

You can build:

Inventory Scripts

Audit Scripts

Log Analysis Scripts

Evidence Collection Scripts

Security Reports

PowerShell for Cybersecurity Checklist

Fundamentals

Programming

Files

Windows

Permissions

Get-Acl understood
File ACLs reviewed
Registry ACLs reviewed
Ownership understood

Event Logs

Networking

Security Controls

Defender status
Firewall profiles
Audit policy
Security controls left enabled

Active Directory

Secure Automation

Projects

40 PowerShell for Cybersecurity Review Questions

What is PowerShell?
Why is PowerShell important for Windows security?
What is a cmdlet?
What does Verb-Noun mean?
What is a PowerShell object?
How is PowerShell’s pipeline different from a text-only shell?
What does Get-Member show?
What does Where-Object do?
What does Select-Object do?
What does Sort-Object do?
What does Group-Object do?
What is a PowerShell array?
What is a hashtable?
What is a PSCustomObject?
Why are PSCustomObjects useful in reporting?
What does Get-Process provide?
What does Get-Service provide?
Why is Get-CimInstance Win32_Service useful?
What does Get-LocalUser provide?
Why should local Administrators membership be reviewed?
What does Get-Acl provide?
Why are ACLs important in security assessments?
How does PowerShell access the Windows Registry?
What does Get-NetTCPConnection provide?
What does Test-NetConnection do?
What is Get-WinEvent used for?
What does event ID 4625 commonly represent?
What does event ID 4624 commonly represent?
Why is PowerShell logging valuable for defenders?
What does Get-MpComputerStatus provide?
Why should Defender not be disabled during normal security testing?
What does Get-NetFirewallProfile show?
What is Active Directory?
How can PowerShell help inventory AD users and groups?
Why are service accounts important?
What does gpresult /r provide?
Why should PowerShell automation run with least privilege?
Why should dynamic code execution be treated carefully?
Why should scripts avoid hard-coded secrets?
What makes a PowerShell security script repeatable and professional?

Final PowerShell for Cybersecurity Mental Model

Remember:

WINDOWS SECURITY DATA
        ↓
POWERSHELL CMDLET
        ↓
OBJECT
        ↓
PIPELINE
        ↓
FILTER
        ↓
SELECT
        ↓
ANALYZE
        ↓
EXPORT
        ↓
SECURITY DECISION

For automation:

COLLECT
   ↓
VALIDATE
   ↓
NORMALIZE
   ↓
ANALYZE
   ↓
REPORT
   ↓
REVIEW

Do not think:

I NEED TO MEMORIZE
EVERY POWERSHELL CMDLET

Think:

WHAT WINDOWS OBJECT
DO I NEED?

WHICH CMDLET
RETURNS IT?

WHICH PROPERTY
MATTERS?

HOW DO I FILTER IT?

HOW DO I TURN IT
INTO A SECURITY RESULT?

For example:

WINDOWS HOST
     ↓
Get-LocalGroupMember
     ↓
ADMINISTRATORS
     ↓
REVIEW MEMBERSHIP
     ↓
SECURITY FINDING

or:

SECURITY EVENT LOG
       ↓
Get-WinEvent
       ↓
FILTER EVENT ID
       ↓
GROUP EVENTS
       ↓
INVESTIGATION SUMMARY

or:

ACTIVE DIRECTORY
       ↓
USERS + GROUPS
       ↓
PRIVILEGE RELATIONSHIPS
       ↓
SECURITY REVIEW

That is PowerShell for cybersecurity:

WINDOWS OBJECTS
      +
SECURITY CONTEXT
      +
AUTOMATION
      =
REPEATABLE SECURITY OPERATIONS

What’s Next?

➡️ 04 — JavaScript Fundamentals

The next module moves into the language that powers much of the modern browser and frontend application ecosystem.

You will learn:

JAVASCRIPT BASICS
      ↓
VARIABLES
      ↓
DATA TYPES
      ↓
FUNCTIONS
      ↓
ARRAYS
      ↓
OBJECTS
      ↓
CONDITIONS
      ↓
LOOPS
      ↓
DOM
      ↓
EVENTS
      ↓
BROWSER STORAGE
      ↓
HTTP REQUESTS
      ↓
JSON
      ↓
ASYNC JAVASCRIPT
      ↓
WEB SECURITY CONTEXT

The goal is not to become a frontend developer.

The goal is to understand enough JavaScript to analyze modern web application behavior, client-side logic, API interactions, browser security boundaries, and application security workflows.

03 — PowerShell for Cybersecurity

PowerShell Learning Path

Why PowerShell Matters in Cybersecurity

PowerShell Mental Model

01 — Start PowerShell

02 — Understand Cmdlets

03 — Discover Commands

04 — Get Help

05 — PowerShell Objects

Why Objects Matter

06 — The Pipeline

Pipeline Mental Model

07 — Variables

08 — Strings

09 — Data Types

10 — Arrays

11 — Hashtables

12 — Conditions

13 — if / elseif / else

14 — Comparison Operators

15 — Logical Operators

16 — Loops

17 — For Loops

18 — While Loops

19 — Functions

20 — Function Parameters

21 — Current Security Context

22 — Identify the Host

23 — System Information

24 — Environment Variables

25 — Filesystem Navigation

26 — Create a Security Workspace

27 — Read Files

28 — Follow a File

29 — Search File Content

30 — Recursive Search

31 — Write Files

32 — CSV

33 — Filter CSV Security Data

34 — Export CSV

35 — JSON

36 — Read JSON

37 — Filtering Objects

38 — Select Properties

39 — Sort Results

40 — Group Results

41 — Measure Results

42 — Processes

43 — Find a Process

44 — Services

45 — Detailed Service Configuration

46 — Service Security Questions

47 — Scheduled Tasks

48 — Local Users

49 — Local Groups

50 — Review Administrators

51 — Group Membership Security

52 — Filesystem Permissions

53 — Permission Security Model

54 — Registry Basics

55 — Read Registry Values

56 — Registry Security

57 — Network Configuration

58 — Routes

59 — DNS Configuration

60 — Network Connections

61 — Map Ports to Processes

62 — Test Connectivity

63 — DNS Lookup

64 — Event Logs

65 — List Event Logs

66 — Read Security Events

67 — Filter by Event ID

68 — Useful Security Events

69 — Failed Login Investigation

70 — Event Object Inspection

71 — Export Event Information

72 — Event Analysis Workflow

73 — PowerShell Operational Logs

74 — Windows Defender

100 — Why `-ErrorAction Stop` Matters