PowerShell is a command-line scripting language and command prompt developed by Microsoft, designed specifically for system management and automation. It combines command execution, scripting, and configuration management into a versatile tool.

PowerShell is built on the .NET Framework, which means that it supports .NET libraries. In practice, this means that if you happen to be familiar with, for example, the C# programming language, you can use familiar classes and functions (.NET modules) in PowerShell.

You can find PowerShell by typing "powershell" into the search field that you can access through the Windows button. Do not choose the top, black "PowerShell 7" but select the blue "Windows PowerShell".

The basic components of PowerShell are cmdlets (pronounced "command-lets"), which are small commands used to perform specific tasks. For example, the 

 cmdlet lists all available cmdlets, and 

 provides instructions for using a cmdlet.

The previous example of the Get-Process command can also be executed using its alias 

You can find out the aliases of the command using the 

When you want help with a cmdlet, you can use the 

PowerShell allows writing scripts that are a set of cmdlets and other commands run in order. Scripts are saved in files with a .ps1 extension.

It is convenient to write and test scripts in Powershell ISE editor.

In PowerShell, you can send the output of one cmdlet to another cmdlet using a pipe (|), enabling the construction of complex command sequences with simple components.

For example, the previous example where processes were searched could be piped to the 

 cmdlet, which can filter the objects returned by the previous command based on their attribute value. This way, only the processes currently using over 10% of the CPU could be listed.

 is a cmdlet that lists processes. The output looks similar to the output of the "ps" command in the Unix world.

However, there is a fundamental difference between Unix and PowerShell commands in cybersecurity: PowerShell returns objects, not text. The objects are simply formatted as text. The type of object can be seen with the Get-Member cmdlet.

The lab takes a couple of minutes to start up, please wait patiently and add more time if needed. You don't need to close the lab between switching modules in this course. You can log in to the server via RDP with the username "

Windows practice

Find out the version of Windows operating system

You can find out the version with this PowerShell command:

## What is Powershell?

PowerShell is a command-line scripting language and command prompt developed by Microsoft, designed specifically for system management and automation. It combines command execution, scripting, and configuration management into a versatile tool.

PowerShell is built on the .NET Framework, which means that it supports .NET libraries. In practice, this means that if you happen to be familiar with, for example, the C# programming language, you can use familiar classes and functions (.NET modules) in PowerShell.

---

## Running Powershell

You can find PowerShell by typing "powershell" into the search field that you can access through the Windows button. Do not choose the top, black "PowerShell 7" but select the blue "Windows PowerShell".

![](sanity:image-4e0e0ddf029d066fd7cd3d3fa4d1c26207ac5065-1672x1388-png)

![](sanity:image-193927429119ccac8e382c596691d9c649488f4a-998x410-png)

---

## Basics of PowerShell

---

## **cmdlets**

The basic components of PowerShell are cmdlets (pronounced "command-lets"), which are small commands used to perform specific tasks. For example, the **Get-Command** cmdlet lists all available cmdlets, and **Get-Help** provides instructions for using a cmdlet.

![](sanity:image-a0251c93e8709c2dc877a37c001f526c8e826632-1402x908-png)

### Powershell has aliases

The previous example of the Get-Process command can also be executed using its alias **ps**.

![](sanity:image-f338c6e92ba5a2ac58a5374d9af421df2926cbb1-988x382-png)

You can find out the aliases of the command using the **Get-Help** command.

### Get-Help cmdlet

When you want help with a cmdlet, you can use the **Get-Help** cmdlet.

![](sanity:image-4a69899656bfd53ce04798a4dec8922fc22cbd61-1058x652-png)

### **Scripting and Powershell ISE**

PowerShell allows writing scripts that are a set of cmdlets and other commands run in order. Scripts are saved in files with a .ps1 extension.

It is convenient to write and test scripts in Powershell ISE editor.

![](sanity:image-83549b0b04ef060d913d645031559d08023b5b0a-1228x884-png)

![](sanity:image-b96c2c871e8b671371b101e7de039f87e5725ed3-1600x968-png)

### **Pipelines**

In PowerShell, you can send the output of one cmdlet to another cmdlet using a pipe (|), enabling the construction of complex command sequences with simple components.

![](sanity:image-8d4327017280076957d71a044270858bfaaf47bc-1034x206-png)

For example, the previous example where processes were searched could be piped to the **Where-Object** cmdlet, which can filter the objects returned by the previous command based on their attribute value. This way, only the processes currently using over 10% of the CPU could be listed.

```powershell
Get-Process | Where-Object {$_.CPU -gt 10}
```

![](sanity:image-0b0568819bef48a909b4d03a04efcd14f70bb8d1-1026x194-png)

### Powershell retrieves objects

**Get-Process** is a cmdlet that lists processes. The output looks similar to the output of the "ps" command in the Unix world.

![](sanity:image-911917685c8898df4e3fe6939e1e1a29aacc1c68-1074x474-png)

However, there is a fundamental difference between Unix and PowerShell commands in cybersecurity: PowerShell returns objects, not text. The objects are simply formatted as text. The type of object can be seen with the Get-Member cmdlet.

![](sanity:image-632947b490d3fd30862c37ffe5d9e30e68d0506c-1172x624-png)

---

## Tasks

@exercise 62d42c39c1a1

### Find out the version of Windows operating system

You can find out the version with this PowerShell command:

```powershell
(Get-CimInstance -ClassName Win32_OperatingSystem).Version
```

@exercise 25505062ca43


Powershell

In this course, we go through the basics related to managing Windows systems and maintaining information security.

In this course, we will go through the basics of Windows system administration and cybersecurity maintenance.

We familiarize ourselves with Windows virus protection, firewall, and automatic updates. We learn to use remote desktop connections, registry editor, PowerShell, server manager, and group policies.

The course does not go into great depth on Windows domains, attacks on them, or hardening. These more advanced topics are covered in the "Windows - Attack and Defense" course.

Powershell

What is Powershell?

Learn to hack — start here