Windows PowerShell Fundamentals for SOC L1: Using PowerShell for Endpoint Investigation

PowerShell is one of the most important Windows skills for anyone building a foundation in SOC L1 / Tier 1 analysis.

It is more than a command-line interface. PowerShell combines a shell, scripting capabilities, and automation functionality, while providing access to information from the Windows operating system.

For a SOC analyst, this makes PowerShell particularly useful for collecting and investigating information about processes, users, files, services, network connections, and other endpoint activity.

The goal of learning PowerShell for SOC work is not to memorize hundreds of commands.

The goal is to understand how PowerShell can help answer a much more important question:

What is happening on this Windows endpoint?

Introduction

During a Windows security investigation, an analyst may need to determine:

• Which user is active?
• Which processes are running?
• What is the process ID?
• Where is an executable located?
• Which process owns a network connection?
• What services are running?
• What files are present?
• Does a suspicious file match another known file?
• Are there unusual file characteristics that require further investigation?

PowerShell provides commands that can help collect this information directly from the endpoint.

A useful investigation model is:

Windows Endpoint
 ↓
User
 ↓
Process
 ↓
Executable
 ↓
File Path
 ↓
Command Line
 ↓
Parent Process
 ↓
Network Connection
 ↓
Event Logs / Sysmon / EDR
 ↓
Detection
 ↓
Investigation
 ↓
Incident Response

This relationship-based approach is more useful than simply memorizing individual commands.

1. What Is PowerShell?

PowerShell is Microsoft’s command-line shell and scripting environment.

One of the fundamental differences between traditional command-line environments and PowerShell is the way information is handled.

Traditional CLI → Text output
PowerShell      → Objects

Instead of treating every result simply as a block of text, PowerShell works extensively with objects and their properties.

This becomes especially useful when investigating large amounts of endpoint information.

Cmdlets

PowerShell commands commonly follow a:

Verb-Noun

naming convention.

Examples include:

Get-Command
Get-Help
Get-Alias
Get-Process
Get-Service

The naming convention makes many commands relatively easy to understand.

For example:

Get-Process

can be understood as:

Get → retrieve information
Process → the type of information

PowerShell is also cross-platform and can run on Windows, Linux, and macOS.

2. Finding PowerShell Commands

Learning how to discover commands is almost as important as learning the commands themselves.

Instead of trying to memorize everything, PowerShell provides commands that can help identify available functionality.

Get available commands

Get-Command

Find functions

Get-Command -CommandType "Function"

Get help

Get-Help Get-Date

View aliases

Get-Alias

Aliases provide shortcuts for commands that may look familiar from other command-line environments.

Examples include:

dir
cd
cat

For SOC work, however, learning the underlying PowerShell cmdlet names is useful because it makes command-line activity easier to interpret.

3. PowerShell Filesystem Operations

PowerShell provides several commands for interacting with files and directories.

Important commands include:

Get-ChildItem
Set-Location
New-Item
Remove-Item
Copy-Item
Move-Item
Get-Content

These commands allow an analyst to navigate the filesystem, examine files, create or remove items, and move or copy data.

For example:

Get-ChildItem .\

The .\ notation represents the current directory.

This can be useful when beginning an endpoint investigation and examining the contents of a particular location.

Why filesystem knowledge matters

Files are frequently part of a security investigation.

An analyst may need to connect:

File
 ↓
Path
 ↓
Owner/User
 ↓
Process
 ↓
Network
 ↓
Logs

PowerShell provides several building blocks for collecting this information.

4. The PowerShell Pipeline

The PowerShell pipeline is one of the most important concepts to understand.

It allows the output from one command to be passed into another command.

For example:

Get-Process | Sort-Object CPU

Here:

Get-Process
     ↓
Pipeline
     ↓
Sort-Object

The process information is passed to Sort-Object, which sorts the results according to the selected property.

This becomes particularly useful when dealing with large amounts of endpoint information.

5. Filtering PowerShell Results

Instead of reviewing every result manually, PowerShell can filter information.

For example:

Get-Process | Where-Object {$_.CPU -gt 100}

This filters the process information based on the CPU property.

Another useful operation is selecting specific properties:

Get-Process | Select-Object Name, Id, CPU

Instead of displaying every available property, the command focuses on:

• Process name
• Process ID
• CPU information

This can make investigation output easier to interpret.

6. Searching Text with Select-String

PowerShell also provides:

Select-String "password" file.txt

This searches the specified file for matching text.

For analysts, text searching can be useful when examining files or other textual information.

The broader concept is:

Large amount of data
        ↓
Search
        ↓
Relevant matches
        ↓
Investigation

Filtering and searching are important because SOC analysts often need to reduce large amounts of information to the specific evidence that matters.

7. System and User Information

Understanding the endpoint itself is an important part of investigation.

PowerShell provides commands such as:

Get-ComputerInfo

and:

systeminfo

User information can be examined with:

Get-LocalUser

These commands provide useful context about the system and local accounts.

8. Network Information

PowerShell can also provide network configuration information.

For example:

Get-NetIPConfiguration

and:

Get-NetIPAddress

These commands can help an analyst understand the network configuration of the endpoint.

Two important loopback addresses are:

127.0.0.1
::1

Understanding addresses such as these helps analysts distinguish local/loopback communication from external network activity.

9. Process Investigation

Process investigation is one of the most important PowerShell use cases for SOC L1.

The basic command is:

Get-Process

A PID, or Process ID, identifies a running process.

However, process investigation should not stop at the process name.

A better approach is:

Process
 ↓
PID
 ↓
Executable
 ↓
File Path
 ↓
Command Line
 ↓
Parent Process
 ↓
User
 ↓
Network Connections
 ↓
Logs / EDR

Why?

Because a process name alone provides limited context.

An analyst needs to understand:

• What process is running?
• Which PID does it have?
• What executable is associated with it?
• Where is the executable located?
• What command line was used?
• Which parent process started it?
• Which user is associated with the activity?
• Is it communicating over the network?
• Do logs or EDR provide additional evidence?

This transforms process investigation from a simple lookup into an evidence-based workflow.

10. Investigating Windows Services

PowerShell can retrieve information about Windows services with:

Get-Service

Services are an important part of the Windows operating system.

An unusual service can therefore become an investigation lead.

However, an unusual service should not automatically be classified as malicious.

Instead, investigate its context.

A useful approach is:

Service
 ↓
Executable
 ↓
User
 ↓
Configuration
 ↓
Process
 ↓
Network
 ↓
Logs

The objective is to determine whether the service is expected and legitimate or whether additional investigation is required.

11. Network Connection Investigation

PowerShell provides:

Get-NetTCPConnection

This can provide important network connection information.

Relevant information includes:

• Local address
• Remote address
• Local port
• Remote port
• Connection state
• Owning process/PID

The important SOC concept is connecting the network connection back to the process that owns it.

Connection
 ↓
Owning PID
 ↓
Process
 ↓
Executable
 ↓
User
 ↓
Network Destination

For example, instead of simply asking:

“What IP address is this endpoint communicating with?”

an analyst can ask:

“Which process is responsible for this connection?”

That provides much stronger investigation context.

12. File Hashing

PowerShell can calculate a hash for a file using:

Get-FileHash suspicious.exe

By default, PowerShell can calculate a SHA-256 hash.

A hash provides an identifier that can be used to compare files.

In a malware investigation, this can help connect a suspicious file to other observations or known file information.

A simple investigation relationship is:

Suspicious File
 ↓
Hash
 ↓
Comparison
 ↓
Additional Evidence

Hashing is therefore another useful piece of evidence rather than a complete investigation by itself.

13. Alternate Data Streams

Windows supports Alternate Data Streams (ADS).

These streams provide another area that analysts should understand when examining suspicious files.

PowerShell can be used to inspect streams with:

Get-Item -Stream *

Unexpected streams can become an investigation lead.

The important point is not that every alternate data stream is malicious.

Instead:

Unexpected ADS
      ↓
Investigate
      ↓
File context
      ↓
User
      ↓
Process
      ↓
Other evidence

As with suspicious processes and services, context determines significance.

14. Building a PowerShell SOC Investigation Workflow

The individual commands become much more useful when combined into a structured investigation process.

Consider a suspicious process.

Start with:

Get-Process

Then think about the information that needs to be connected:

Process
 ↓
PID
 ↓
Executable
 ↓
Path
 ↓
Command Line
 ↓
Parent Process
 ↓
User
 ↓
Network
 ↓
Logs / EDR

For a suspicious network connection:

Network Connection
 ↓
Owning PID
 ↓
Process
 ↓
Executable
 ↓
User
 ↓
Destination
 ↓
Logs / EDR

For a suspicious file:

File
 ↓
Path
 ↓
Hash
 ↓
Process
 ↓
User
 ↓
Network
 ↓
Logs

This approach encourages evidence correlation rather than isolated command execution.

15. Why PowerShell Matters to SOC Analysts

PowerShell is particularly valuable because it can interact with different parts of the Windows endpoint.

An analyst can use it to examine:

Users
 ↓
Processes
 ↓
Services
 ↓
Files
 ↓
Network
 ↓
System information

This makes PowerShell useful for both routine endpoint investigation and gathering information during security incidents.

At the same time, PowerShell should not be viewed as inherently malicious.

The same capability that helps defenders investigate an endpoint can also be used to perform legitimate administration and automation.

Therefore, seeing PowerShell activity alone is not enough to determine whether something is malicious.

The surrounding context matters.

16. The PowerShell SOC Mental Model

The main mental model I want to retain is:

Windows Endpoint
 ↓
User
 ↓
Process
 ↓
Executable
 ↓
File Path
 ↓
Command Line
 ↓
Parent Process
 ↓
Network Connection
 ↓
Event Logs / Sysmon / EDR
 ↓
Detection
 ↓
Investigation
 ↓
Incident Response

Each layer adds context.

For example:

A process tells us what is running.

A PID identifies the specific process.

The executable and path tell us what is actually being executed and where it is located.

The command line provides additional execution context.

The parent process can help explain how the process started.

The user provides account context.

The network connection shows whether the process is communicating.

Finally, logs, Sysmon, and EDR can provide additional evidence for the investigation.

Key Takeaways

1. Learn cmdlets, not only aliases

Commands such as:

Get-Process
Get-Service
Get-Command

are more useful to understand than relying exclusively on aliases.

2. Learn the pipeline

The pipeline makes it possible to combine commands and reduce large datasets into useful information.

3. Investigate relationships

A process should be connected to its:

PID
 ↓
Executable
 ↓
Path
 ↓
Command Line
 ↓
Parent
 ↓
User
 ↓
Network

4. Don’t classify activity from one indicator

A suspicious process, service, network connection, or ADS is an investigation lead.

It is not automatically proof of malicious activity.

5. PowerShell should be learned as an investigation tool

The objective is not:

“I know PowerShell commands.”

The objective is:

“I can use PowerShell to investigate a Windows endpoint.”

Conclusion

PowerShell provides SOC analysts with a practical way to interact with and investigate Windows endpoints.

The most valuable lesson is not memorizing individual commands.

It is learning how to connect evidence.

User
 ↓
Process
 ↓
Executable
 ↓
File
 ↓
Service
 ↓
Network
 ↓
Logs / EDR
 ↓
Investigation

When these relationships are understood, PowerShell becomes more than a command-line interface.

It becomes part of an analyst’s investigation workflow.

For me, this is an important step in building stronger Windows, PowerShell, SOC L1, and Blue Team fundamentals.