100 Cybersecurity One-Liners (PowerShell, Bash, CMD)

InfosecPandey

Follow

4 min read

·

Jun 14, 2025

3

Listen

Share

Welcome to the dark arts of the cyber command line!

Below is a curated arsenal of 100 cybersecurity one-liners that are perfect for incident response, threat hunting, enumeration, privilege escalation, or just flexing at your next CTF.

Each one-liner is like a mini-hack spell — quick, precise, and battle-tested.

PowerShell One-Liners

1. Get-LocalUser | Where-Object {$_.Enabled -eq $true} — List all enabled local users.
2. Get-EventLog -LogName Security -Newest 10 — Show the last 10 Security events.
3. Get-Service | Where-Object {$_.Status -eq 'Running'} — List running services.
4. Get-ChildItem -Recurse -Force C:\Users | Where-Object {$_.Attributes -match 'Hidden'} — Find hidden files.
5. Get-Process | Sort CPU -Descending | Select -First 5 — Top 5 CPU hogging processes.
6. Get-NetTCPConnection -State Listen — List all listening TCP ports.
7. Test-Connection google.com -Count 3 — Quick ping test.
8. Get-WmiObject -Class Win32_Product | Select-Object Name — List installed programs.
9. Get-Command *password* — Find commands related to 'password'.
10. whoami /priv — List current privileges.

Bash One-Liners

1. whoami && id — Show user and UID info.