PowerShell for Security Analysts

Module 0 of PowerShell for Security Analysts: why defenders use PowerShell, Windows PowerShell 5.1 and PowerShell 7, how PowerShell is built, the console, Terminal and VS Code, cmdlets, functions, scripts and modules, finding your way around, an administrator's tool and an attacker's tool, and building an analyst workstation.

Module 1 of PowerShell for Security Analysts: objects and the pipeline, filtering and comparison, logic, wildcards and regular expressions, variables and collections, loops, functions and error handling, and reducing endpoint data to an answer.

Module 2 of PowerShell for Security Analysts: CSV, JSON and REST responses, XML, plain text and Select-String, CliXml, sorting and grouping, calculated properties, and comparing datasets.

Module 3 of PowerShell for Security Analysts: what the machine is, its patches, boot time and uptime, installed software, services and drivers, local users, groups and administrators, recently changed accounts, and Active Directory accounts.

Module 4 of PowerShell for Security Analysts: Get-Process and Win32_Process, parent, path, command line and user, process trees, LOLBins and suspicious chains, connections and listeners, the DNS cache, and correlating processes with the addresses they reach.

Module 5 of PowerShell for Security Analysts: finding files, timestamps, hidden and recent files, hashing, signatures and PE files, alternate data streams and the mark of the web, the registry provider, persistence and configuration keys, and USB, RDP and recent-activity keys.

Module 6 of PowerShell for Security Analysts: logs, providers and event IDs, Get-WinEvent and FilterHashtable, XPath and event XML, logon, process and privilege events, services, tasks and account changes, the Sysmon, Defender, RDP and WMI logs, and a security timeline tool.

Module 7 of PowerShell for Security Analysts: script block, module and transcription logging, events 4103, 4104, 400 and 800, PSReadLine history, encoded commands, download cradles, obfuscation and safe deobfuscation, AMSI tampering as evidence, and execution policy and Constrained Language Mode.

Module 8 of PowerShell for Security Analysts: scheduled tasks, services and Run keys across a fleet, startup folders and PowerShell profiles, WMI event subscriptions, DLL search-order abuse, Defender status and signatures, threats, exclusions and tampering, and a persistence hunter.

Module 9 of PowerShell for Security Analysts: a repeatable triage method, the host triage collector, evidence integrity with hashing and case metadata, the incident evidence collector, hunting one indicator and many with an IOC scanner, and remote collection with WinRM, credentials and JEA.

Module 10 of PowerShell for Security Analysts: REST calls with headers and authentication, JSON paging and rate limits, reputation lookups, API keys as secrets, Microsoft Graph PowerShell, Entra ID sign-in data, the Defender XDR and Sentinel APIs, and an enriched report from an alert.

Module 11 of PowerShell for Security Analysts: from one-liners to functions, parameters and validation, logging and help, configuration and credentials, risk scoring, modules and the analyst toolkit, signing, JEA, WDAC and AppLocker, and checking a script you did not write.

One sheet per module of PowerShell for Security Analysts, each entry a question, a command that answers it against the course evidence with its real output, what to read and what the answer does not prove.

Procedures for the three problems every PowerShell analyst meets: a command that returns nothing, a collection that is incomplete, and an evidence file nobody has read before.

The course evidence, which runs every lesson on any machine with PowerShell 7, and a Windows virtual machine of your own for the live commands, with the logging and remoting the course relies on.

Six worked investigations on the course evidence, each from the question handed to you to the finding written honestly, with every command run and every wrong turn shown.

Six hunting patterns in PowerShell, each run on the course evidence: rare across the fleet, rare configuration, new since the baseline, Office starting a shell, paired events in sequence, and start then connect.

Places to practice PowerShell for security work and things to keep open while you do: the course evidence, the detection library, the SOC simulator, the playbook suite, an open-source DFIR toolkit, and reference pages.

Every command, check and trap from PowerShell for Security Analysts in one place, organized by the task in front of you and linked back to the lesson that explains it.

The documentation behind PowerShell for Security Analysts, arranged by the question it answers: the language and its editions, logs and evidence, PowerShell's own security, remoting and APIs, tools and review, and incident response practice.

The PowerShell for Security Analysts project: a brief for investigating one compromised laptop from its incident package alone, with the course's PowerShell, from first alert to a PowerShell-generated investigation report. No submission, no grading.

PowerShell for Security Analysts end-of-course exam: twenty-two tasks, two per teaching module, each answered by writing PowerShell against an evidence set the course did not investigate, and checked on the server.