Windows Reconnaissance with PowerShell

PowerShell is the deepest built-in recon surface on Windows: every defensive control, security product, network state, and domain object is queryable without dropping a binary. This page covers host-level situational awareness (AV/EDR, firewall, event logs, processes); for domain-level queries see active-directory-enumeration and PowerView, and for cmd.exe built-ins see windows-reconnaissance-commands.

Defensive product discovery

# Enumerate registered antivirus products
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct
 
# Windows Defender state
Get-Service WinDefend
Get-MpComputerStatus | select RealTimeProtectionEnabled
Get-MpThreat                                  # recent detections
 
# Sysmon — the attacker's worst enemy; three checks plus a registry check
Get-Process | Where-Object { $_.ProcessName -eq "Sysmon" }
Get-CimInstance win32_service -Filter "Description = 'System Monitor service'"
Get-Service | Where-Object { $_.DisplayName -like "*sysm*" }
# HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon\Operational

Finding Sysmon running changes the whole engagement: process creation (EID 1), network connections (EID 3), and image loads (EID 7) are all being recorded — see windows-event-logs.

Firewall and network

Get-NetFirewallProfile | Format-Table Name, Enabled
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False   # requires admin
Get-NetFirewallRule | select DisplayName, Enabled, Description
 
Test-NetConnection -ComputerName $HOST -Port $PORT
(New-Object System.Net.Sockets.TcpClient("$HOST", "$PORT")).Connected

Host inventory

Get-EventLog -List                          # which logs exist
Get-ChildItem -Hidden -Path $PATH           # hidden directories
Get-Process -Name $IMAGE_NAME               # process by image name

PowerShell command history

Every user’s PSReadLine history persists plaintext commands — frequently including credentials, connection strings, and internal hostnames:

type $Env:USERPROFILE\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

Use %USERPROFILE% instead of $Env:USERPROFILE from cmd.exe. Harvesting this file is MITRE T1552-adjacent (unsecured credentials) and one of the highest-yield single-file reads on a compromised host.

Domain touchpoints (if domain-joined)

Get-ADUser -Filter *                                              # all domain users
Get-ADUser -Filter * -SearchBase "CN=Users,DC=example,DC=com"     # LDAP subtree

These require the RSAT ActiveDirectory module — deeper coverage in active-directory-enumeration.

Sources

• Discovery — MITRE ATT&CK TA0007
• Defender Module — Microsoft Learn
• NetSecurity Module — Microsoft Learn

Related: windows-reconnaissance-commands, active-directory-enumeration, powerview, windows-event-logs, amsi-bypass, active-directory-lateral-movement.