Windows Fundamentals · beginner · ~11 min

PowerShell basics for operators

Use PowerShell's object pipeline for enumeration and understand its security controls.

Overview

PowerShell is the object-oriented Windows shell. Cmdlets (Verb-Noun) pipe objects, so you filter on properties — ideal for native enumeration (services, users, ACLs, logs). Execution Policy is safety, not security; AMSI/script-block logging are the real controls.

Why it matters

PowerShell is the standard way to enumerate and operate on Windows without dropping external tools. Knowing its logging/AMSI controls tells you what defenders see, and recognising that Execution Policy isn't a security boundary is a common report correction.

Core concepts

Cmdlets. Verb-Noun (Get-Service, Get-LocalUser, Get-Acl). Object pipeline. Filter on properties, not text. Execution Policy. Safety feature, not a boundary. AMSI / script-block logging. What defenders use to detect PowerShell abuse.

Lesson

PowerShell is the Windows automation shell and the primary tool for both administering and assessing Windows — the rough equivalent of bash on Linux, but object-oriented.

Cmdlets and the object pipeline

Commands are cmdlets in Verb-Noun form: Get-Process, Get-Service, Get-LocalUser, Get-ChildItem. Unlike bash (which pipes text), PowerShell pipes objects, so you filter on properties:

Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, StartType

Why testers use it

Native, present on every modern Windows host, and great for enumeration without dropping tools: list services, users, ACLs (Get-Acl), scheduled tasks, and network config. Get-WinEvent reads logs.

Security controls (both sides)

  • Execution Policy restricts script running — a safety feature, not a security boundary (trivially bypassed with -ExecutionPolicy Bypass); don't treat it as protection in a report.
  • Script Block Logging / AMSI / transcription let defenders log and scan PowerShell activity — which is exactly why "living off the land" via PowerShell is increasingly detectable.

Defensive note

Constrained Language Mode, AMSI, and logging are the recommended hardening; flag their absence.

Summary

PowerShell's object pipeline makes it the go-to for native Windows enumeration; its real security controls are AMSI and logging (not Execution Policy), and their presence determines how visible activity is.