Windows PowerShell: Advanced Object Filtering and Enterprise Automation

Introduction

Welcome to my walkthrough of the Windows PowerShell room! This room marks an exciting progression within the Command Line module of TryHackMe's Cyber Security 101 pathway.

In my previous article, Windows Command Line, we stepped away from the graphical interface entirely to master the raw command-line utilities built directly into the Windows operating system. Now, we are pivoting from basic text-based terminal prompts up to advanced, object-oriented system automation.

In this room, Windows PowerShell, we will dive into a powerful shell environment designed to handle automated administration, script auditing, and sophisticated data pipeline management. This walkthrough serves as a comprehensive guide to completing the room tasks, demonstrating exactly how to manipulate file structures, extract real-time system diagnostics, and execute remote commands directly from the console interface.

Catch up on my previous article Windows Command Line by clicking the banner below.

What we will cover

• Navigating the file system and managing files using object-oriented cmdlets like Get-ChildItem and Get-Content
• Building advanced command pipelines to filter, sort, and isolate data patterns using Select-String and comparison operators
• Conducting real-time system analysis to audit running processes, network connections, and hidden Alternate Data Streams (ADS)
• Leveraging Invoke-Command to execute automated administrative scripts across remote target hosts

Room Information

Before we dive into the tasks, here is a quick overview of the room details.

• Room Name: Windows PowerShell
• Path: Cyber Security 101
• Module: Command Line
• Topic: Automated Administration & Shell Auditing
• Difficulty: Easy
• Room Link: TryHackMe — Windows PowerShell

Task 1: Introduction

Ahoy there! If you're here, you've either heard whispers of the marvels of PowerShell and want to discover more, or you've sailed over from the first room of the Command Line module, Windows Command Line. Either way, you're about to embark on a journey to discover the marvels of this powerful shell, learning how to use it to uncover the secrets of any Windows system. Avast, then — on board!

Learning Objectives

This is the second room in the Command Line module. It is an introductory room to PowerShell, the second — only historically — command-line utility built for the Windows operating system.

• Learn what PowerShell is and its architectural capabilities.
• Understand the basic structure of PowerShell's language environment.
• Learn and run fundamental PowerShell commands.
• Understand PowerShell's many applications in the cyber security industry.

Task 2: What Is PowerShell

From the official Microsoft documentation:

"PowerShell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework."

PowerShell combines a command-line interface and a scripting language built natively on the .NET framework. Unlike older text-based command-line tools, PowerShell is object-oriented, meaning it passes complex data types and interacts with system components directly rather than treating output as raw text streams. Originally exclusive to Windows, PowerShell has since expanded to support macOS and Linux, making it a versatile option for IT professionals across diverse enterprise environments.

A Brief History of PowerShell

PowerShell was developed to overcome the strict limitations of legacy command-line tools and scripting environments in Windows. In the early 2000s, traditional tools like cmd.exe and batch files fell short in automating complex administrative operations. Microsoft engineer Jeffrey Snover realized that Windows handled system operations via structured APIs, while Unix treated everything as text files.

Snover's solution was to develop an object-oriented shell environment. Released in 2006, PowerShell allowed administrators to automate tasks effectively by manipulating active objects. In 2016, Microsoft expanded its ecosystem by releasing PowerShell Core, an open-source, cross-platform iteration running across Windows, macOS, and Linux.

The Power in PowerShell

To fully grasp the capabilities of PowerShell, we must define what an object represents. In programming, an object is an item bundle containing:

• Properties: The characteristics of the item (e.g., file sizes, extension names, or usernames).
• Methods: The programmatic actions that can be performed on the item (e.g., copying a file, halting a thread, or stopping a service).

Traditional shells drop execution data entirely into unparsed text strings. When a cmdlet (pronounced command-let) runs in PowerShell, it outputs structured objects that retain their properties and methods natively. This eliminates the need for messy string parsing (like grep, awk, or findstr) when building long automation chains.

Questions and Answers

What do we call the advanced approach used to develop PowerShell?

Answer:

object-oriented

object-oriented

Task 3: PowerShell Basics

Before exploring PowerShell's features, launch your target lab machine and open your terminal connection. For remote CLI-only administration instances, you can drop straight into a PowerShell session directly from a standard Command Prompt (cmd.exe) by typing powershell and hitting Enter.

PowerShell cmdlets strictly follow a consistent Verb-Noun naming convention, making command discovery highly predictable. The Verb describes the action while the Noun specifies the target system component, as seen when Get-Content retrieves a file layout or Set-Location updates the current directory context. To navigate this ecosystem, Get-Command lists available cmdlets, aliases, and functions, which can be filtered by appending specific command types. When you need structural syntax rules or working snippets, Get-Help provides documentation, especially when combined with specialized parameters to view functional switch options.

Transitioning to this environment is simplified through built-in aliases managed by Get-Alias, which maps legacy shortcuts to modern counterparts, translating commands like dir into Get-ChildItem. Furthermore, PowerShell handles external capability expansion via online package repositories like the PowerShell Gallery. Administrators can leverage Find-Module to search for third-party scripts using wildcard filters and run Install-Module to provision the newly discovered management toolsets directly onto the host operating system.

Guided Walkthrough: Command Discovery and Alias Mapping

To complete the practical challenges in this section, we will walk through discovery operations using core helper cmdlets to find specific system parameters and documentation layouts.

Our first objective is to locate all tools associated with systemic deletions. By running Get-Command -Name Remove*, we utilize wildcards to query every command beginning with that specific action verb, which instantly filters the environment's structural index to display matching aliases and functions.

Next, we need to uncover legacy shorthand mapping patterns. By executing Get-Alias, the shell generates a complete translation table of short commands. Scrolling through these entries reveals exactly which modern cmdlet acts as the underlying target for traditional terminal functions like echo.

Finally, to understand the syntax of account creation without breaking the operational flow, we pull up live implementation blueprints. Running Get-Help New-LocalUser -examples parses the internal help documentation and exposes practical code blocks demonstrating exactly how parameters are constructed.

Questions and Answers

How would you retrieve a list of commands that start with the verb Remove? [for the sake of this question, avoid the use of quotes (" or ') in your answer]

Answer:

Get-Command -Name Remove*

Get-Command -Name Remove*

What cmdlet has its traditional counterpart echo as an alias?

Answer:

Write-Output

Write-Output

What is the command to retrieve some example usage for the cmdlet New-LocalUser?

Answer:

Get-Help New-LocalUser -examples

Get-Help New-LocalUser -examples

Task 4: Navigating the File System and Working with Files

Navigating directory layouts and interacting with files represents the core workflow of any command-line investigator. While traditional shells treat files as static blobs of text, PowerShell looks at everything through its object-oriented engine, meaning directories and files are returned as rich data objects complete with built-in metadata properties.

To read the structural contents of a directory, Get-ChildItem acts as your primary radar. It lists files, folders, and underlying attributes, accepting explicit pathways via the -Path parameter or recursive discovery flags via -Recurse. Moving between folders relies on Get-Item or the location-changing engine Set-Location. When it comes to analyzing files themselves, Get-Content pulls data directly into the shell session. Instead of forcing you to use external utilities, this cmdlet opens data streams natively, allowing analysts to quickly audit logs, view configuration metrics, or extract hidden strings straight from the terminal interface.

Guided Walkthrough: Directory Trees and Metadata Extraction

To crack the practical challenges for this task, we will inspect command mappings and map out a directory tree on our target system.

Our first step requires identifying how a classic file-viewing utility translates into the PowerShell landscape. By checking our environment's active aliases with the shell helper engine, we can pinpoint exactly which native command responds under the hood. Looking closely at the registered translation mappings, the legacy command type points directly to its object-oriented counterpart, Get-Content.

With our file-viewing utility identified, our next move is to inspect the user profiles on the host asset. By passing an explicit path directly to our directory analysis engine using Get-ChildItem -Path C:\Users, the console indexes the target directory and prints out its active structure. The resulting table displays the metadata and folder names, immediately showing that there are 4 items housed under this directory path.

Questions and Answers

What cmdlet can you use instead of the traditional Windows command type?

Answer:

Get-Content

Get-Content

What PowerShell command would you use to display the content of the "C:\Users" directory? [for the sake of this question, avoid the use of quotes (" or ') in your answer]

Answer:

Get-ChildItem -Path C:\Users

Get-ChildItem -Path C:\Users

How many items are displayed by the command described in the previous question?

Answer:

4

4

Task 5: Piping, Filtering, and Sorting Data

The true strength of an object-oriented shell environment becomes apparent when you need to sort through massive streams of administrative data. In legacy consoles, isolating specific elements requires complex text-parsing expressions to slice up plain text. PowerShell completely bypasses this friction by introducing the pipeline operator (|), which passes entire object structures from one cmdlet to the next. Because the underlying data objects retain all their native characteristics down the line, downstream cmdlets can instantly filter or rearrange data based on explicit file or system criteria.

Managing this pipeline data relies heavily on data arrangement and conditional sorting filters. By using Sort-Object, investigators can reorganize tables instantly according to specific parameters like creation dates or file size tags. To drop unneeded noise entirely, Where-Object acts as a powerful structural gateway. It evaluates incoming data objects against clear conditional rules, using mathematical comparison switches like -eq (equals), -ne (not equal), -gt (greater than), or -lt (less than). This mechanism allows analysts to quickly run precise logic sweeps, like checking a server farm for any running service whose memory usage exceeds a targeted threshold.

Guided Walkthrough: Pipeline Filtering and Size Boundaries

To complete the challenge in this section, we need to locate specific files inside the captain's quarters based entirely on their physical footprint.

When we look inside the current directory using the standard ls shortcut, the shell indexes three distinct files: captain-boots.txt, captain-hat.txt, and ship-flag.txt. Our task is to isolate files that surpass a defined size criteria without sorting through the directory table manually.

To achieve this, we can pipe our directory listing command into a conditional data filter by running Get-ChildItem | Where-Object -Property Length -gt 100. The pipeline passes the file objects directly into our evaluation filter, which reviews the Length attribute of each item. This filters out the empty zero-byte text file entirely, leaving only the two items that successfully clear the mathematical evaluation gate.

Questions and Answers

How would you retrieve the items in the current directory with size greater than 100? [for the sake of this question, avoid the use of quotes (" or ') in your answer]

Answer:

Get-ChildItem | Where-Object -Property Length -gt 100

Get-ChildItem | Where-Object -Property Length -gt 100

Task 6: System and Network Information

To perform deep security audits, we must look past simple file layouts and interact directly with active core operating system entities. PowerShell provides a robust tier of cmdlets built explicitly to parse, track, and manage complex system frameworks like system properties, account architectures, and active system properties.

Auditing system properties relies on specialized diagnostic engines. When validating target environment patch statuses or verifying basic platform architectures, Get-ComputerInfo aggregates extensive OS details into a centralized data object. When tracking localized host access structures, Get-LocalUser lists every profile configured on the device, parsing attributes like account status, security descriptions, and login flags. Beyond user layers, data discovery within text bodies is managed via Select-String, which searches strings across large datasets using matching syntax. Furthermore, when investigating windows network settings or parsing system boundaries, variables like $env:COMPUTERNAME dynamically pull structural configuration data straight from active environment memory layers.

Guided Walkthrough: Account Enumeration and Directory Pivoting

To solve the challenges in this section, we will audit the host's active account structures and follow a directory path to locate a hidden asset.

Our first step is to enumerate the local accounts configured on the system. By executing Get-LocalUser, the shell queries the local security subsystem and prints a comprehensive table detailing account names, activation statuses, and description strings. Reviewing this output immediately reveals an anomalous account named p1r4t3 carrying a distinct description that matches the pirate theme: "A merry life and a short one."

With the target profile identified, our next move is to pivot into their dedicated directory tree. We transition our working environment by running Set-Location -Path C:\Users\p1r4t3 and follow up with Get-ChildItem to list the active subdirectories. Among the standard directories, a folder named hidden-treasure-chest stands out.

We jump directly into this directory by running Set-Location -Path C:\Users\p1r4t3\hidden-treasure-chest and check its contents with another folder index query. The command reveals a single file called big-treasure.txt. To extract its data, we execute Get-Content big-treasure.txt, which prints an ASCII art graphic alongside our hidden system flag.

Questions and Answers

Other than your current user and the default "Administrator" account, what other user is enabled on the lab machine?

Answer:

p1r4t3

p1r4t3

This lad has hidden his account among the others with no regard for our beloved captain! What is the motto he has so bluntly put as his account's description?

Answer:

A merry life and a short one.

A merry life and a short one.

Now a small challenge to put it all together. This shady lad that we just found hidden among the local users has his own home folder in the "C:\Users" directory. Can you navigate the filesystem and find the hidden treasure inside this pirate's home?

Answer:

THM{p34rlInAsh3ll}

THM{p34rlInAsh3ll}

Task 7: Real-Time System Analysis

To gather more advanced system information — especially concerning dynamic aspects like running processes, active services, and live network configurations — we leverage a robust tier of diagnostic cmdlets that go far beyond static machine properties.

Monitoring live parameters relies on direct interaction with the system's operational layers. For inspecting active resource consumption, Get-Process acts as a flexible command-line task manager, tracking system handles and active memory baselines. To map network connectivity, Get-NetTCPConnection details open ports and active connection paths, surfacing crucial internal parameters like the underlying process identifier responsible for binding a specific network socket. Furthermore, checking file authenticity is handled via Get-FileHash, which builds distinct cryptographic signatures to verify file integrity. Analysts can even sweep the host environment for hidden configurations by checking NTFS Alternate Data Streams using Get-Item combined with stream-matching arguments.

Guided Walkthrough: Cryptographic Hashing and Service Filtering

To crack the system telemetry challenges in this section, we will calculate file fingerprints, examine active network parameters, and use our previous discoveries to unearth a hidden system service.

Our first step is to generate a unique cryptographic fingerprint for the treasure asset we discovered earlier. By remaining in the hidden directory and executing Get-FileHash big-treasure.txt, the utility runs a SHA256 integrity scan against the target file object. The terminal immediately outputs a long alphanumeric string, providing the exact file hash needed to verify its baseline integrity.

Next, we need to inspect the host's active network footprints to identify how process attachments are structured by default. By running Get-NetTCPConnection, the engine dumps a table mapping out localized IP endpoints and active connection states. Reviewing the default header structures reveals that the column explicitly displaying the Process ID responsible for creating the socket is named OwningProcess.

Finally, we encounter a tougher challenge: tracking down a background service whose display name has been modified to mimic our pirate motto from the user account audit ("A merry life and a short one."). We can solve this cleanly by combining our cmdlets. By executing Get-Service | Where-Object -Property "DisplayName" -eq "A merry life and a short one.", the full service registry is piped into our conditional filter. The pipeline matches our string perfectly, isolating a single running service whose actual name property is revealed to be p1r4t3-s-compass.

Questions and Answers

In the previous task, you found a marvellous treasure carefully hidden in the lab machine. What is the hash of the file that contains it?

Answer:

71FC5EC11C2497A32F8F08E61399687D90ABE6E204D2964DF589543A613F3E08

71FC5EC11C2497A32F8F08E61399687D90ABE6E204D2964DF589543A613F3E08

What property retrieved by default by Get-NetTCPConnection contains information about the process that has started the connection?

Answer:

OwningProcess

OwningProcess

It's time for another small challenge. Some vital service has been installed on this pirate ship to guarantee that the captain can always navigate safely. But something isn't working as expected, and the captain wonders why. Investigating, they find out the truth, at last: the service has been tampered with! The shady lad from before has modified the service DisplayName to reflect his very own motto, the same that he put in his user description. With this information and the PowerShell knowledge you have built so far, can you find the service name?

Answer:

p1r4t3-s-compass

p1r4t3-s-compass

Task 8: Scripting

Scripting is the process of stringing together a sequence of operations inside a simple text file (.ps1), allowing the computer to carry out highly complex administrative logic automatically. By consolidating long terminal operations into reusable files, security practitioners and engineers can ensure absolute consistency, minimize execution errors, and orchestrate large-scale deployments across an entire enterprise footprint.

Automation plays a critical role across all core cybersecurity and infrastructure operations. Inside defensive operations, blue teams build automation scripts to systematically parse system event logs, audit networks for indicators of compromise, and sweep hosts for malicious persistence mechanisms. Conversely, offensive red teams leverage scripts to conduct rapid infrastructure enumeration, pass remote payloads, and execute post-exploitation tasks with speed and precision. For day-to-day operations, system engineers deploy automated compliance checks, distribute software packages remotely, and manage configuration baselines across vast enterprise networks.

Managing these scripts at scale relies heavily on remote execution frameworks. The Invoke-Command cmdlet enables administrators to run scripts or individual cmdlets across multiple remote endpoints simultaneously. When working with local script files, passing the path flag via Invoke-Command -FilePath c:\scripts\test.ps1 -ComputerName Server01 pushes the logic directly to the target node. Alternatively, operators can completely bypass saving local files by wrapping instructions in an inline array and executing commands instantly using the syntax: Invoke-Command -ComputerName [name] -ScriptBlock { Get-Service }.

Questions and Answers

What is the syntax to execute the command Get-Service on a remote computer named "RoyalFortune"? Assume you don't need to provide credentials to establish the connection. [for the sake of this question, avoid the use of quotes (" or ') in your answer]

Answer:

Invoke-Command -ComputerName RoyalFortune -ScriptBlock { Get-Service }

Invoke-Command -ComputerName RoyalFortune -ScriptBlock { Get-Service }

Summary & Key Takeaways

Well done, mateys! You've successfully navigated the treacherous waters of PowerShell, uncovering hidden treasures and elusive services aboard TheBlackPearl. With these tools in your belt, you're well-equipped to explore even the most guarded corners of any Windows system. Proceed next to the Linux Command Line room to keep expanding your terminal toolkit!

Key lessons:

• Object Oriented Processing: Shifted away from standard text parsing, understanding that PowerShell passes rich data streams retaining structural properties across pipelines.
• Predictable Cmdlet Verb-Noun Architecture: Mastered command discovery mechanics utilizing the intuitive Verb-Noun syntax standard.
• Deep Pipeline Filtering: Learned to combine Sort-Object, Where-Object, and comparison matching operators (-eq, -gt) to cleanly isolate targeted system telemetry.
• Live System Telemetry: Acquired essential techniques to hunt down rogue connections, audit hidden files via data streams, and evaluate file hashes.