How to Find a Suspicious Process on Windows with Get-Process
Find a suspicious process on Windows with Get-Process: executable path, digital signature, parent process and network …
Windows 34 posts
Information security in plain English: scams, hardening and privacy — plus retrogaming, games and geek culture.
How to Check Your PC Hardware with PowerShell (Get-CimInstance)
See CPU, RAM, BIOS, graphics card and serial number with Get-CimInstance: a PowerShell hardware inventory for one PC or …
How to Check SSD and HDD Health with PowerShell (Get-PhysicalDisk)
Check SSD and HDD health with Get-PhysicalDisk and Get-StorageReliabilityCounter: temperature, wear, power-on hours and …
Get-NetFirewallRule: Audit Windows Firewall Rules
How to use Get-NetFirewallRule in PowerShell to list open inbound rules, spot suspicious exceptions and export a Windows …
Get-ScheduledTask: find suspicious scheduled tasks on Windows
Use Get-ScheduledTask in PowerShell to list scheduled tasks, spot malware persistence and see what each one runs. …
Test-NetConnection: Test Remote Ports and Connectivity in PowerShell
Use Test-NetConnection in PowerShell to test remote ports, check connectivity, and replace ping, telnet, and traceroute …
What Is Kerberoasting? The Attack That Exploits Active Directory Service Accounts
Kerberoasting lets any domain user extract service account hashes from Windows and crack them offline — no admin rights …
Get-FileHash in PowerShell: verify a file's SHA256 hash
Learn to use Get-FileHash in PowerShell to calculate and compare SHA256 hashes — confirm a downloaded file is legitimate …
Pass-the-Hash: how the NTLM attack works without the password
Pass-the-Hash uses a stolen NTLM hash to authenticate on the network without needing the real password. Learn the …
Invoke-WebRequest: download files and test URLs in PowerShell
Learn to use Invoke-WebRequest in PowerShell to download files, check HTTP status, and query REST APIs — no browser …