🖥️ Windows Command Cheat Sheet for Security Analysts
Investigate Smarter Monitor Deeper Respond Like a Pro
Windows is packed with powerful native tools that security analysts can leverage for threat hunting, incident response, and digital forensics no third party tools required
This quick-reference guide outlines essential Windows commands to accelerate your triage and live response investigations 🚨.
🖥️ Windows Command Cheat Sheet for Security Analysts
Investigate Smarter. Monitor Deeper. Respond Like a Pro. 🛡️🔍
Windows is packed with powerful native tools that security analysts can leverage for threat hunting, incident response, and digital forensics no third-party tools required 🧰
This quick-reference guide outlines essential Windows commands to accelerate your triage and live response investigations
SMB (Server Message Block) is a Windows protocol for sharing files and services. In pentests or labs, SMB enumeration can uncover open shares, weak permissions, and sensitive data often without full access.
🧠 Key Concepts
• Understand what SMB is and why it matters after initial recon
• Identify SMB services running on ports 139 and 445
• Enumerate shares, sessions, users, and files sometimes anonymously
• Use tools to automate and speed up the process
Wireless credential dumping is the lab-based extraction of Wi-Fi passwords to understand and prevent key leaks 🛡️
🧠 Common Wireless Credential Dumping Techniques:
🔸 Windows Stored Wi-Fi Keys
View saved networks using:
netsh wlan show profiles
netsh wlan show profile “SSID” key=clear
🔸 Linux Systems
Wi-Fi creds are often stored in:
/etc/NetworkManager/system-connections/
🔸 Rogue AP / Evil Twin
Set up fake access points to trick devices into connecting — capture the handshake and crack it offline using aircrack-ng or hashcat.
🔸 WPA2-PSK Handshake Attacks
Use airodump-ng and aireplay-ng to capture handshakes for brute-force attempts
✅ DNS (Domain Name System)
Think of DNS as the internet’s contact list. It turns domain names (like ) into IP addresses (142.250.x.x) so devices can talk
1.Browser checks cache 🔎
2.If not found, it asks your DNS resolver (ISP, etc.)
3.Resolver queries the root ➡️ TLD ➡️ Authoritative name server
IP is returned, and the site loads 🎯4.Final
🛰️ ASN (Autonomous System Number)
An ASN identifies a network (ISP, cloud provider, etc.) on the internet using BGP (Border Gateway Protocol)
⚙️ Why It Matters
•ASNs own IP blocks
•They tell the internet: “I manage these IPs”
•Routers use this info to route traffic