Most people learning ethical hacking start with Kali Linux, Nmap, Metasploit, and Python. Those tools are useful, but there is another powerful tool already installed on millions of Windows computers that beginners often overlook: PowerShell.

PowerShell is more than a command prompt. It is a scripting language, an automation framework, and a way to interact with Windows services, processes, users, files, network connections, and security logs.

For cybersecurity professionals, this makes it incredibly useful.

You can use PowerShell to investigate suspicious processes, discover open ports on your own machine, inspect firewall rules, examine Windows event logs, automate security checks, and build your own defensive reconnaissance scripts.

The interesting part? You can start learning without installing an expensive toolkit.

In this guide, we’ll explore how PowerShell fits into ethical hacking, 15 practical commands worth learning, examples you can run on your own Windows computer, and how to combine them into a simple security audit script.

What Is PowerShell?

PowerShell is a command-line shell and scripting language developed by Microsoft. It works with structured objects rather than relying exclusively on plain text, making it especially useful for automating system administration and security investigations.

Unlike traditional Command Prompt commands, PowerShell commands commonly return objects with properties you can filter, sort, and analyze.

For example, you can retrieve every running process, filter for a particular name, sort by memory usage, and export the results to a CSV file.

Official documentation: https://learn.microsoft.com/en-us/powershell/

PowerShell is available on Windows, and PowerShell 7 can also run on Linux and macOS.

Why Do Ethical Hackers Learn PowerShell?

Windows is common in corporate networks, business environments, and personal computers. Security professionals therefore need a reliable way to investigate Windows systems without installing a separate tool for every task.

PowerShell helps with several important areas of cybersecurity.

PowerShell can also be abused by attackers to execute commands or automate malicious activity. Security teams monitor it for this reason. Learning how it works helps you recognize legitimate administration and investigate suspicious usage.

Microsoft’s PowerShell security documentation explains its security controls and recommendations: https://learn.microsoft.com/en-us/powershell/scripting/security/overview

Before You Start

Open PowerShell on Windows by searching for PowerShell in the Start menu. You can also use Windows Terminal.

For the examples in this article:

• Use your own computer or a lab machine.
• Run commands without administrator privileges unless a task specifically requires elevation.
• Only inspect networks and systems you own or have permission to test.
• Don’t disable security controls or execute unfamiliar scripts simply because a tutorial recommends them.

You can check your PowerShell version with:

$PSVersionTable

Now let’s get into the practical commands.

1. Get-ComputerInfo: Discover System Information

One of the first things a security analyst needs to understand is the system being investigated.

Get-ComputerInfo retrieves information about your Windows installation and hardware.

Get-ComputerInfo

The output includes information such as the Windows version, operating system architecture, computer name, and system configuration.

To focus on a few useful properties:

Get-ComputerInfo |
    Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture

Why is this useful for cybersecurity?

System information helps analysts understand whether a machine is running an outdated operating system or whether an investigation involves a particular Windows environment.

For example, when preparing an internal security assessment, you might record the operating system version before reviewing its patch status.

Practical tip: Collect system information at the beginning of an authorized investigation so you can document exactly which machine you examined.

2. Get-NetIPConfiguration: Inspect Network Configuration

Your network configuration tells you how your computer connects to other devices.

Run:

Get-NetIPConfiguration

You can inspect the network adapter, assigned IP address, default gateway, and DNS server information.

For a more focused view:

Get-NetIPAddress |
    Select-Object InterfaceAlias, AddressFamily, IPAddress

What can you learn?

Suppose your computer has an address such as 192.168.1.25 and a default gateway of 192.168.1.1.

That tells you your machine is using a private IPv4 address on a local network. It does not reveal your public IP address by itself.

This is useful when troubleshooting network issues or documenting a lab environment before testing connectivity.

3. Get-NetTCPConnection: See Active Network Connections

This is one of the most useful commands for basic Windows security investigations.

Get-NetTCPConnection

It displays TCP connections and listening endpoints known to Windows, including local and remote addresses, ports, and connection states.

To display only established connections:

Get-NetTCPConnection -State Established

To make the output easier to inspect:

Get-NetTCPConnection -State Established |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State

How security analysts use it

Imagine your computer is behaving unusually, and you want to understand which TCP connections are currently established.

You can inspect the remote addresses and ports, then correlate those observations with the processes running on the system.

A remote connection to an unfamiliar address is not automatically malicious. Browsers, cloud applications, operating system services, and software updates regularly communicate with remote servers.

The objective is to identify connections that deserve further investigation rather than treating every unfamiliar connection as evidence of an attack.

4. Test-NetConnection: Test Ports and Network Reachability

Security professionals often need to establish whether a service is reachable on a particular port.

PowerShell includes Test-NetConnection for this purpose.

For example, to test HTTPS connectivity to a server you are authorized to assess:

Test-NetConnection example.com -Port 443

Look for the TcpTestSucceeded property.

A value of True means the TCP connection succeeded. A value of False means the connection could not be established under the conditions of that test.

It does not necessarily mean a firewall is blocking the connection; routing issues, DNS problems, and a service that is not listening can produce similar results.

Example: Check an internal web server

Test-NetConnection 192.168.1.50 -Port 443

Replace the example address with a server you own or have explicit permission to test.

This is useful for troubleshooting services and validating firewall configurations. It is not a replacement for a comprehensive vulnerability assessment.

5. Get-Process: Investigate Running Processes

A process is a running instance of a program.

Use:

Get-Process

To find a particular process:

Get-Process -Name notepad

To identify processes consuming significant memory:

Get-Process |
    Sort-Object WorkingSet64 -Descending |
    Select-Object -First 10 Name, Id, WorkingSet64

Why this matters

During incident response, analysts investigate processes that consume unusual resources, have unexpected names, or run in suspicious circumstances.

However, process names alone cannot establish whether software is malicious. Malware can imitate legitimate names, while legitimate applications can behave unexpectedly.

If you find a process you don’t recognize, investigate its executable path, signature, parent process, and associated network connections before deciding what to do.

6. Get-Service: Inspect Windows Services

Windows services often run in the background and provide important operating system functionality.

List services with:

Get-Service

Display services that are currently running:

Get-Service |
    Where-Object Status -eq 'Running'

To inspect one service:

Get-Service -Name wuauserv

The example checks the Windows Update service.

Security use case

During a Windows security audit, you may need to identify unexpected services or verify that important services are running.

An unfamiliar service is not necessarily malicious. Before changing anything, investigate its executable path, publisher, startup configuration, and purpose.

Avoid disabling services simply because their names look unfamiliar. Some are essential for networking, security, updates, or device functionality.

7. Get-LocalUser: Review Local User Accounts

User accounts are an important part of Windows security.

Run:

Get-LocalUser

To see a few relevant properties:

Get-LocalUser |
    Select-Object Name, Enabled, LastLogon

You can also inspect local groups:

Get-LocalGroup

On supported Windows editions, review members of the local Administrators group:

Get-LocalGroupMember -Group "Administrators"

What should you look for?

• Accounts you do not recognize
• Unexpected accounts with administrative privileges
• Disabled accounts that have been unexpectedly re-enabled
• Accounts that should no longer exist

A last-logon value is not a complete record of account activity, and some environments may not provide reliable values for every account.

For a more thorough investigation, correlate account information with Windows Security event logs and your organization’s identity management records.

8. Get-NetFirewallProfile: Check Windows Firewall

The Windows firewall helps control inbound and outbound network traffic.

Check its profile configuration:

Get-NetFirewallProfile

To focus on whether the firewall is enabled:

Get-NetFirewallProfile |
    Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

Windows normally uses profiles for Domain, Private, and Public networks.

Why is this useful?

A firewall that is disabled unexpectedly can indicate a configuration problem or a potential security concern.

However, the correct configuration depends on the environment. Enterprise networks may apply policies centrally, and a firewall rule’s existence does not automatically mean a service is exposed to the internet.

For a personal Windows computer, verify that the appropriate firewall profiles are enabled and investigate any unexpected changes.

Official documentation: https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallprofile

9. Get-WinEvent: Investigate Windows Event Logs

Windows event logs are among the most valuable sources of information during a security investigation.

PowerShell’s Get-WinEvent command allows you to retrieve and filter events from supported Windows event logs.

For example, inspect recent System log events:

Get-WinEvent -LogName System -MaxEvents 20

To view selected properties:

Get-WinEvent -LogName System -MaxEvents 20 |
    Select-Object TimeCreated, Id, ProviderName, LevelDisplayName

Investigating failed logons

On a Windows system where the relevant auditing is enabled and you have permission to inspect the Security log, you can query failed logon events:

Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id      = 4625
} -MaxEvents 20

Event ID 4625 represents a failed logon attempt.

Depending on the event details, you may be able to examine the account involved, the logon type, and source information.

Keep in mind that permissions, audit policy, event retention, and system configuration affect what is available.

Important: A failed login does not automatically mean a successful intrusion occurred. Security analysts look for patterns, repeated failures, unusual accounts, and related events.

10. Get-AuthenticodeSignature: Check a File’s Digital Signature

Before investigating a suspicious executable or script, checking its digital signature can provide useful context.

For example:

Get-AuthenticodeSignature "C:\Path\To\File.exe"

Replace the example path with the file you want to inspect.

The command returns signature information and a status such as Valid, NotSigned, or another status indicating a problem.

Does a valid signature mean a file is safe?

No.

A valid signature indicates that the file’s signature passed the relevant verification checks. It does not prove that the program is harmless or that its behavior is appropriate.

Likewise, many legitimate scripts are unsigned.

Treat signature information as one investigative signal alongside the file’s source, hash, behavior, and reputation.

11. Get-FileHash: Calculate a File Hash

A cryptographic hash creates a fixed-length value representing a file’s contents.

Use:

Get-FileHash "C:\Path\To\File.exe" -Algorithm SHA256

This calculates the file’s SHA-256 hash.

Why do security analysts use hashes?

Hashes help identify files and determine whether two files have identical contents.

During incident response, an analyst can record the hash of a suspicious file and compare it with trusted reference data or an authorized malware-analysis database.

If the file changes, its hash will normally change as well.

A hash is not encryption, and calculating one does not reveal the contents of a file. It is simply a useful identifier for further analysis.

12. Get-ChildItem: Find Files Worth Investigating

PowerShell can enumerate files and directories.

For example, list files in your Downloads folder:

Get-ChildItem "$HOME\Downloads"

Find executable files in that folder:

Get-ChildItem "$HOME\Downloads" -File -Recurse -Filter *.exe

You can also inspect modification times:

Get-ChildItem "$HOME\Downloads" -File |
    Select-Object Name, Length, LastWriteTime

Security use case

Suppose you recently downloaded a program and want to review what is present in your Downloads folder.

You can list executable files, inspect their properties, calculate hashes, and verify signatures.

This is a useful starting point for an investigation, but file extension and modification time alone cannot establish whether a file is malicious.

13. Select-String: Search Text and Logs

PowerShell’s Select-String searches text for matching patterns.

For example:

Select-String -Path ".\application.log" -Pattern "error"

This searches the specified log file for lines containing error.

You can search for multiple terms:

Select-String -Path ".\application.log" -Pattern "error", "warning", "failed"

Why is this useful?

Security investigations frequently involve large text files, application logs, exported event data, and diagnostic output.

Instead of reading everything manually, you can filter for terms that deserve attention.

Remember that a search only finds matching text. The absence of a matching term does not prove that an incident did not occur.

14. Export-Csv: Create a Security Audit Report

Collecting information is useful, but being able to save it makes the results easier to review.

For example, export a list of running processes:

Get-Process |
    Select-Object Name, Id, CPU, WorkingSet64 |
    Export-Csv "$HOME\Desktop\process-report.csv" -NoTypeInformation

PowerShell creates a CSV file on your desktop that can be opened in a spreadsheet application.

You can use the same technique to save process lists, service inventories, firewall configurations, or other authorized audit results.

Be mindful of the contents: system reports can contain usernames, paths, network addresses, and other information that should not be published indiscriminately.

15. Get-Help: Learn Commands Directly in PowerShell

You do not need to memorize every command.

PowerShell has a built-in help system:

Get-Help Get-NetTCPConnection

For examples:

Get-Help Get-NetTCPConnection -Examples

Depending on your PowerShell installation, you may need to update the local help files before detailed documentation is available.

You can also consult the official Microsoft Learn documentation at https://learn.microsoft.com/en-us/powershell/.

Learning to read command documentation is a core skill. It helps you understand parameters, expected output, permissions, and potential side effects before running a command.

Build a Simple Windows Security Audit Script

Now let’s combine several of these commands into a small script.

This example collects basic system, process, service, firewall, and network information from the computer where it runs. It creates a report directory and writes local CSV files.

It does not scan external networks, change system configuration, or send collected information anywhere.

Save the following as WindowsSecurityAudit.ps1:

$ErrorActionPreference = 'Stop'
$reportDir = Join-Path $HOME 'Desktop\SecurityAudit'
New-Item -Path $reportDir -ItemType Directory -Force |
    Out-Null
# System information
Get-ComputerInfo |
    Select-Object CsName, WindowsProductName,
                  WindowsVersion, OsArchitecture |
    Export-Csv (Join-Path $reportDir 'system.csv') `
        -NoTypeInformation
# Running processes
Get-Process |
    Select-Object Name, Id, CPU, WorkingSet64 |
    Export-Csv (Join-Path $reportDir 'processes.csv') `
        -NoTypeInformation
# Services
Get-Service |
    Select-Object Name, DisplayName, Status, StartType |
    Export-Csv (Join-Path $reportDir 'services.csv') `
        -NoTypeInformation
# Firewall profiles
Get-NetFirewallProfile |
    Select-Object Name, Enabled, DefaultInboundAction,
                  DefaultOutboundAction |
    Export-Csv (Join-Path $reportDir 'firewall.csv') `
        -NoTypeInformation
# Active TCP connections
Get-NetTCPConnection -State Established |
    Select-Object LocalAddress, LocalPort,
                  RemoteAddress, RemotePort, State |
    Export-Csv (Join-Path $reportDir 'connections.csv') `
        -NoTypeInformation
Write-Host "Audit completed. Reports saved to: $reportDir"

How to run it

1. Save the script as WindowsSecurityAudit.ps1.
2. Open PowerShell.
3. Navigate to the folder where you saved the script.
4. Run it using .\WindowsSecurityAudit.ps1.

If your current execution policy prevents running the script, do not automatically weaken system-wide security settings. Review your organization’s policy and Microsoft’s documentation first.

Some commands may require additional permissions or behave differently across Windows editions.

What will you get?

The script creates a SecurityAudit directory on your desktop containing:

• system.csv
• processes.csv
• services.csv
• firewall.csv
• connections.csv

These reports are snapshots, not a complete malware scan or proof that the computer is secure. Review unfamiliar findings before taking action.

Can PowerShell Replace Kali Linux Tools?

Not entirely.

PowerShell is particularly strong for Windows administration, automation, and local investigation. Specialized security tools provide additional capabilities for network discovery, packet analysis, web application testing, and vulnerability assessment.

A good cybersecurity professional learns how to choose the appropriate tool for the job rather than trying to use one tool for everything.

PowerShell Security: How Defenders Detect Abuse

PowerShell is legitimate software, but attackers can misuse it. This is why organizations monitor how it is used rather than simply assuming every PowerShell command is harmless.

Useful defensive measures include:

• Enable appropriate PowerShell logging and Windows security auditing.
• Review suspicious script execution and unusual parent-child process relationships.
• Apply application control policies where appropriate.
• Restrict administrative privileges.
• Keep Windows and security software updated.
• Investigate unexpected changes to services, firewall settings, and scheduled tasks.

Microsoft provides guidance on PowerShell security, including application control and security considerations for remoting:

Common Mistakes Beginners Make

Running PowerShell as administrator for everything. Elevated privileges increase the consequences of mistakes. Use standard permissions when possible.

Copying commands without understanding them. Read the documentation before running commands that modify services, permissions, files, or network settings.

Treating unfamiliar processes as malware. Investigate context, signatures, paths, and behavior before drawing conclusions.

Assuming a successful port test proves a service is vulnerable. Reachability and vulnerability are different things.

Ignoring logs. Security auditing becomes much more useful when you understand the events surrounding a suspicious process or connection.

Trying to learn everything at once. Start with system enumeration, networking, processes, services, and event logs. Build on those foundations.

A Practical 7-Day PowerShell Learning Plan

By the end of the week, you will have a useful foundation for Windows security investigations and repeatable system checks.

Frequently Asked Questions

Is PowerShell useful for ethical hacking?

Yes. PowerShell is useful for Windows enumeration, system administration, network troubleshooting, incident response, log analysis, and security automation.

Is PowerShell better than Python for hacking?

Neither is universally better. PowerShell is especially convenient for interacting with Windows, while Python is widely used for custom scripts, data processing, APIs, and cross-platform automation.

Can PowerShell find open ports?

PowerShell can inspect listening endpoints on your own machine and test whether a port is reachable on an authorized remote system. These are different tasks, and neither automatically identifies a vulnerability.

Can PowerShell detect malware?

PowerShell can collect information that helps investigate suspicious processes, services, files, connections, and event logs. It is not a replacement for a dedicated endpoint detection or antivirus solution.

Do I need Kali Linux to learn ethical hacking?

No. You can learn many Windows security and administration fundamentals directly on a Windows computer. Kali Linux becomes useful when you want to explore additional security tools and workflows.

Is PowerShell available on Linux?

Yes. PowerShell 7 supports Windows, Linux, and macOS, although some Windows-specific commands and modules are unavailable on other operating systems.

Final Thoughts

PowerShell is one of the most practical skills a Windows-focused cybersecurity beginner can learn.

You can use it to inspect processes, investigate connections, review firewall configuration, analyze event logs, calculate file hashes, and automate repetitive security checks—all without starting with a complicated collection of tools.

The best way to learn is to run the commands, understand the output, and document what you discover in your own lab.

Start with the 15 commands in this guide, build the audit script, and gradually expand it as your knowledge improves.

Want to get better at ethical hacking? Learn to understand the systems you’re protecting before you try to test their defenses.

Useful resources:

• PowerShell documentation: https://learn.microsoft.com/en-us/powershell/
• PowerShell security guidance: https://learn.microsoft.com/en-us/powershell/scripting/security/overview
• Windows Sysinternals: https://learn.microsoft.com/en-us/sysinternals/
• Nmap: https://nmap.org/
• Wireshark: https://www.wireshark.org/

Think Like a Hacker. Defend Like a Pro.