[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572516-105":53,"doc-detail-572516-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","powershell-incident-response-cheat-sheet-v10-quick-reference","PowerShell Incident Response Cheat Sheet - v1.0 - quick reference","","PowerShell Incident Response Cheat Sheet provides a rapid, analyst-focused reference for collecting and triaging key evidence during live SOC investigations. It outlines core PowerShell cmdlets used to retrieve file, registry, log, and system information, including event logs, processes, services, scheduled tasks, networking, DNS cache, users, device history, and security-related artifacts. It also includes formatting and output cmdlets (table/list/wide, sorting, grouping, measuring, and exporting) and collection examples for scalable remote evidence gathering.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/powershell-incident-response-cheat-sheet-v10-quick-reference/572516/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/powershell-incident-response-cheat-sheet-v10-quick-reference/572516.png","ImageObject",442,249,{"name":88,"@type":89},"Alex Sinclair","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-21","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",7,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What is the purpose of this PowerShell Incident Response Cheat Sheet?","Question",{"text":109,"@type":110},"It helps SOC analysts rapidly collect and triage key artifacts during live response investigations so time-critical evidence is handled efficiently.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"Which types of evidence can core cmdlets help gather?",{"text":114,"@type":110},"They support metadata retrieval, file and log reading, searching for keywords, querying system info via CIM/WMI, listing processes and services, and extracting event log and networking details.",{"name":116,"@type":107,"acceptedAnswer":117},"How does the cheat sheet support organizing and exporting investigation results?",{"text":118,"@type":110},"It includes formatting cmdlets for tables/lists/wide views and utilities like Select-Object, Sort-Object, Group-Object, and Measure-Object, plus export options such as converting to JSON/CSV and writing to files.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572516,1792087327,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":47},1099523882182,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","Security Operations (SOC) 201 TCM Security Academy  \n[https://academy.tcm-sec.com](https://academy.tcm-sec.com)  \nPowerShell Incident Response Cheat Sheet  \nWhen every second counts, efficient evidence collection makes all the difference. This quick reference is designed to help analysts rapidly collect and triage key artifacts during a live response investigation.  \nCore Cmdlets  \nA cmdlet is a lightweight, single-function command built into PowerShell. Cmdlets are designed to perform specific tasks, like retrieving system information or managing processes. They’re the building blocks for gathering and analyzing data efficiently during investigations.  \n\n| Command | Alias | Description |\n| --- | --- | --- |\n| Get-Item | gi | Retrieves metadata about a single file or registry key. |\n| Get-ChildItem | dir, gci, ls | Lists files and directories (used for browsing file system paths and artifacts) . |\n| Get-ItemProperty | gp | Retrieves file or registry key properties ( LastAccessTime, registry value name/data, etc. ) . |\n| Get-Content | cat, gc, type | Reads contents of text-based log files, scripts, and configuration files. |\n| Select-String | sls | Searches file contents or command output for keywords. |\n| Get-WmiObject (deprecated) | gwmi | Queries WMI providers for system information (legacy use) . |\n| Get-CimInstance | gcim | Queries CIM/WMI providers for system info (modern replacement for Get-WmiObject) . |\n| Get-Process | gps, ps | Lists all running processes with names, PIDs, and resource usage. |\n| Get-Service | gsv | Lists services and their states (running, stopped, startup type, etc. ) . |\n| Get-ScheduledTask | (none) | Lists scheduled tasks and their execution details. |\n| Get-WinEvent | (none) | Retrieves event logs (System, Security, Application, etc. ) with a number of filtering options. |\n\nPowerShell Incident Response Cheat Sheet | v1.0  [https://soc201.com/PSIR ](https://soc201.com/PSIR  | 1/13)[ |](https://soc201.com/PSIR  | 1/13)[ 1/13](https://soc201.com/PSIR  | 1/13)  \nSecurity Operations (SOC) 201 TCM Security Academy  \n[https://academy.tcm-sec.com](https://academy.tcm-sec.com)  \n\n| Get-NetTCPConnection | (none) | Lists active TCP connections and listening ports, including owning process IDs. |\n| --- | --- | --- |\n| Get-NetAdapter | (none) | Displays network interface details and configuration. |\n| Get-NetIPAddress | (none) | Display IP address configuration ( IPv4/ IPv6) and IP interfaces with which addresses are associated. |\n| Get-SmbShare | (none) | Lists SMB file shares hosted on the system, including their paths. |\n| Get-DnsClientCache | (none) | Shows cached DNS query results on the local machine. |\n| Get-LocalUser | g lu | Lists local user accounts on the system. |\n| Get-LocalGroupMember | glgm | Shows members of local groups (e.g. , Administrators) . |\n| Get-HotFix | (none) | Lists installed updates and patches on the system. |\n| Get-PnpDevice | (none) | Enumerates plug-and-play devices, including USB hardware history. |\n| Get-MpPreference | (none) | Retrieves Windows Defender preferences, exclusions, and scan settings. |\n| Get-Acl | (none) | Displays file or registry permissions. |\n| Get-Date | (none) | Displays current system time. |\n| Get-FileHash | (none) | Generates file hashes ( MD5/SHA1/SHA256) for integrity checks or IOC matching. |\n| Write-Host | (none) | Displays messages directly to the console. Commonly used for interactive output within scripts. |\n\nPowerShell Incident Response Cheat Sheet | v1.0  [https://soc201.com/PSIR ](https://soc201.com/PSIR  | 2/13)[ |](https://soc201.com/PSIR  | 2/13)[ 2/13](https://soc201.com/PSIR  | 2/13)  \nSecurity Operations (SOC) 201 TCM Security Academy  \n[https://academy.tcm-sec.com](https://academy.tcm-sec.com)  \nFormatting and Output Cmdlets  \nDuring investigations, we often need to sort, filter, and transform that information to surface patterns and find  \nmeaning. PowerShell’s formatting cmdlets let you quickly transform raw output into something cle","cbCailu0PKj3d7pw","https://ap.wps.com/l/cbCailu0PKj3d7pw","pdf",508245,13,"English","# Core Cmdlets\n## Cmdlet overview\n# Formatting and Output Cmdlets\n## Sorting, grouping, and exporting\n# Collection Examples\n## Remote collection","[{\"question\":\"What is the purpose of this PowerShell Incident Response Cheat Sheet?\",\"answer\":\"It helps SOC analysts rapidly collect and triage key artifacts during live response investigations so time-critical evidence is handled efficiently.\"},{\"question\":\"Which types of evidence can core cmdlets help gather?\",\"answer\":\"They support metadata retrieval, file and log reading, searching for keywords, querying system info via CIM/WMI, listing processes and services, and extracting event log and networking details.\"},{\"question\":\"How does the cheat sheet support organizing and exporting investigation results?\",\"answer\":\"It includes formatting cmdlets for tables/lists/wide views and utilities like Select-Object, Sort-Object, Group-Object, and Measure-Object, plus export options such as converting to JSON/CSV and writing to files.\"}]","PowerShell Incident Response Cheat Sheet - v1.0 - quick reference | PDF",1791927830]