← All cheat sheets

WINDOWS LIVE RESPONSE (BUILT-IN TOOLS)

Plain-text reference · 17 KB. Read it, search it (Ctrl-F) or print it.

First-hour collection on a RUNNING Windows host you suspect is compromised,
using only what ships with Windows 10/11 and Windows Server 2016 and later:
Windows PowerShell 5.1, cmd tools, wevtutil, reg, robocopy and vssadmin.
This sheet is about the ORDER of collection, writing every result to files,
and knowing what each command changes on the host. It does not explain what
the results mean; for that use the PowerShell Blue Team sheet (hunting
queries, WMI subscriptions), Windows Persistence Locations, Windows Security
Event IDs, KAPE and EZ Tools (offline parsing), Memory Forensics (RAM
capture) and Incident Response (process, chain of custody).

Before you start: get approval under your IR plan, open an ELEVATED Windows
PowerShell (Run as administrator), and write to external media or a network
share, never to C:. Use an account whose password you can reset afterwards:
anything you type on a compromised host can be captured (ATT&CK T1003.001).
RFC 3227 warns that the programs on the system cannot be trusted; with
built-in tools you accept that risk, so prefer memory and disk images
(Memory Forensics, KAPE) when the case may go to court.

1. ORDER OF VOLATILITY ON WINDOWS#

RFC 3227 (BCP 55) orders evidence from most to least volatile: registers and
cache; routing table, ARP cache, process table, kernel statistics, memory;
temporary file systems; disk; remote logs; physical configuration and
network topology; archival media. On a Windows host that becomes:
  1  memory image (not built in; see Memory Forensics) -- before anything
  2  network: TCP/UDP endpoints, DNS cache, ARP/neighbors, routes, SMB
  3  processes, services and their command lines, then hashes
  4  logged-on users and sessions
  5  Prefetch listing (your own tools start adding entries)
  6  scheduled tasks, Run keys, Defender state
  7  event logs (they roll over), registry hives, shadow copy list
  8  hash everything, close the transcript, hand over
RFC 3227 also says: do not shut down before collection is complete
(memory is lost and shutdown scripts may destroy evidence), and note that
pulling the network cable can trigger a "deadman switch". Decide isolation
with the incident lead; it is not a reflex.

2. WHAT YOUR COMMANDS CHANGE ON THE HOST#

Read-only (they only leave the traces listed below):
  Get-* cmdlets, netstat, tasklist, query user/session, ipconfig /displaydns,
  arp -a, route print, whoami, systeminfo, schtasks /query, reg query,
  wevtutil el/gl/gli, vssadmin list
Write only to the destination you give them:
  Start-Transcript, Export-Csv, Out-File, wevtutil epl, reg save, robocopy,
  Get-FileHash ... | Export-Csv
Do NOT run during collection (they destroy or change evidence):
  ipconfig /flushdns              empties the DNS client cache
  arp -d, route delete/add        change ARP and routing state
  wevtutil cl, Clear-EventLog     clear a log (what attackers do, T1685.005)
  vssadmin delete shadows         deletes shadow copies (T1490)
  vssadmin resize shadowstorage   can make shadow copies disappear
  Start-MpScan, full AV scans     can quarantine or delete the sample
  Set-MpPreference, Add-MpPreference   change Defender settings
  Stop-Process, sc.exe stop, deleting tasks or accounts
                                  containment: AFTER collection, per plan
  shutdown, restart, logoff of the suspect user
Traces you always leave: each program you start is a new process (Security
4688 when process auditing is on, Sysmon event 1 if installed), PowerShell
can log your script blocks (4104 in Microsoft-Windows-PowerShell/Operational),
your logon writes a 4624, and listing folders can update Last Access times
(check: fsutil behavior query disablelastaccess). Note your start time and
account so the timeline can separate you from the attacker.

3. EVIDENCE FOLDER, CLOCK AND TRANSCRIPT#

E: below is your external drive; a UNC path (\\server\share\IR) also works.
Run once per PowerShell window; every later block uses $E.
  $ts = (Get-Date).ToUniversalTime().ToString("yyyyMMdd'T'HHmmss'Z'")
  $E = "E:\IR\$env:COMPUTERNAME-$ts"
  New-Item -ItemType Directory -Path $E -Force | Out-Null
  Start-Transcript -Path "$E\transcript.txt" -IncludeInvocationHeader
  Get-Date -Format o | Out-File "$E\start-time.txt"
  Get-TimeZone | Format-List | Out-File "$E\timezone.txt"
  systeminfo /fo CSV > "$E\systeminfo.csv"
  whoami /all > "$E\whoami-collector.txt"      # YOUR token, for the record
-IncludeInvocationHeader writes a time stamp for every command, which gives
you a log of your own actions. Compare the host clock with a trusted clock
and write the difference in your notes; every time you collect depends on
it. In Windows PowerShell 5.1, > and Out-File write UTF-16 text.

4. NETWORK STATE (ATT&CK T1071, T1021.001, T1021.002)#

Inspect (PowerShell, full objects to CSV):
  Get-NetTCPConnection | Export-Csv "$E\net-tcp.csv" -NoTypeInformation
  Get-NetUDPEndpoint | Export-Csv "$E\net-udp.csv" -NoTypeInformation
  Get-DnsClientCache | Export-Csv "$E\dns-cache.csv" -NoTypeInformation
  Get-NetNeighbor | Export-Csv "$E\net-neighbor.csv" -NoTypeInformation
  Get-NetRoute | Export-Csv "$E\net-route.csv" -NoTypeInformation
  Get-SmbSession | Export-Csv "$E\smb-sessions.csv" -NoTypeInformation
  Get-SmbOpenFile | Export-Csv "$E\smb-openfiles.csv" -NoTypeInformation
  Get-SmbShare | Export-Csv "$E\smb-shares.csv" -NoTypeInformation
Inspect (cmd tools, same data as text; also work in cmd.exe with E:\...):
  netstat -ano > "$E\netstat-ano.txt"          # -o adds the owning PID
  netstat -anob > "$E\netstat-anob.txt"        # -b adds the executable
  ipconfig /displaydns > "$E\displaydns.txt"   # includes Hosts entries
  arp -a > "$E\arp.txt"
  route print > "$E\route.txt"
Get-NetTCPConnection has OwningProcess and CreationTime; join OwningProcess
with ProcessId in section 5.
Flags: connections to public addresses owned by processes that have no
reason to talk out (notepad.exe, rundll32.exe, an unknown name); inbound
RDP (3389) or SMB sessions from workstations instead of admin hosts; a DNS
cache full of long random-looking names; shares that were not there before.

5. PROCESSES, SIGNATURES AND SERVICES#

(ATT&CK T1036.005, T1059.001, T1047, T1543.003)
Inspect:
  Get-CimInstance Win32_Process |
    Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,
    CommandLine,CreationDate |
    Export-Csv "$E\proc.csv" -NoTypeInformation
  Get-Process -IncludeUserName |
    Export-Csv "$E\proc-users.csv" -NoTypeInformation
  Get-CimInstance Win32_Service |
    Select-Object Name,State,StartMode,StartName,ProcessId,PathName |
    Export-Csv "$E\services.csv" -NoTypeInformation
  tasklist /v /fo csv > "$E\tasklist-v.csv"
  tasklist /svc > "$E\tasklist-svc.txt"        # services per process
Hash and check the signature of every running executable:
  $exe = Get-CimInstance Win32_Process | Where-Object ExecutablePath |
    Select-Object -ExpandProperty ExecutablePath -Unique
  Get-FileHash -LiteralPath $exe |
    Export-Csv "$E\proc-sha256.csv" -NoTypeInformation
  Get-AuthenticodeSignature -FilePath $exe |
    Select-Object Path,Status,StatusMessage |
    Export-Csv "$E\proc-signatures.csv" -NoTypeInformation
Get-Process -IncludeUserName needs elevation. Get-FileHash uses SHA256 by
default; -LiteralPath takes the path list as is ([ ] are not wildcards).
Flags: system names (svchost.exe, lsass.exe) running from outside
C:\Windows\System32; powershell.exe with -EncodedCommand or a download in
the command line; cmd or powershell children of wmiprvse.exe or of an
Office app; services whose PathName is in a user, Temp or ProgramData
folder; a signature Status other than Valid on a binary that should be
signed. Interpretation and more queries: PowerShell Blue Team sheet.

6. SESSIONS, ACCOUNTS AND GROUPS (ATT&CK T1078.003, T1136.001)#

Inspect:
  query user > "$E\query-user.txt"             # same as quser
  query session > "$E\query-session.txt"       # same as qwinsta
  Get-LocalUser | Select-Object * |
    Export-Csv "$E\local-users.csv" -NoTypeInformation
  Get-LocalGroupMember -SID S-1-5-32-544 |
    Export-Csv "$E\local-admins.csv" -NoTypeInformation
S-1-5-32-544 is the built-in Administrators group on every language of
Windows; the name "Administrators" is localized.
Flags: a local account nobody can explain; the built-in Administrator
(SID ending in -500) or Guest enabled; new members of Administrators; an
active RDP session for a user who should not be on this host. Do not log
the suspect user off: their session and processes are evidence.

7. PREFETCH: LIST AND COPY EARLY#

Inspect:
  Get-ChildItem C:\Windows\Prefetch -Filter *.pf |
    Sort-Object LastWriteTime -Descending |
    Select-Object Name,Length,CreationTime,LastWriteTime |
    Export-Csv "$E\prefetch-list.csv" -NoTypeInformation
  robocopy C:\Windows\Prefetch "$E\Prefetch" *.pf /r:0 /w:0 /np
robocopy copies data, attributes and time stamps by default (/copy:DAT);
/r:0 /w:0 stops it retrying a failed file a million times. The folder can
be empty or Prefetch can be turned off; write that down. Programs you start
can add their own .pf files (robocopy too), which is why this comes early.
Parse the copies offline with PECmd (EZ Tools sheet). Files Windows keeps
open (Amcache.hve, SRUM, $MFT) cannot be copied this way: collect them with
KAPE or from a disk image.

8. SCHEDULED TASKS AND RUN KEYS: SNAPSHOT ONLY#

(ATT&CK T1053.005, T1547.001)
Inspect:
  schtasks /query /fo CSV /v > "$E\schtasks.csv"
  Get-ScheduledTask | Get-ScheduledTaskInfo |
    Export-Csv "$E\task-info.csv" -NoTypeInformation
  Get-ScheduledTask | Export-Clixml "$E\tasks.xml"   # full objects
  $k = 'HKLM\Software\Microsoft\Windows\CurrentVersion'
  reg query "$k\Run" > "$E\run-hklm.txt"
  reg query "$k\RunOnce" >> "$E\run-hklm.txt"
HKCU in an elevated window is YOUR profile, not the suspect user's. A
logged-on user's keys are under HKU\<SID>, for example:
  reg query "HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run"
The hive copies from section 10 hold every other location; the full list is
in the Windows Persistence Locations sheet.
Flags: tasks or Run values pointing into user, Temp or ProgramData folders;
tasks created in the incident window; powershell, mshta or rundll32 as the
action.

9. DEFENDER STATE AND EXCLUSIONS (ATT&CK T1685)#

Inspect (all properties to text, read them after):
  Get-MpComputerStatus | Format-List * | Out-File "$E\mp-status.txt"
  Get-MpPreference | Format-List * | Out-File "$E\mp-prefs.txt"
  Get-MpThreatDetection | Format-List * | Out-File "$E\mp-detections.txt"
  Get-MpThreat | Format-List * | Out-File "$E\mp-threats.txt"
Read first: AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled,
BehaviorMonitorEnabled, IsTamperProtected and AntivirusSignatureLastUpdated
(status); ExclusionPath, ExclusionProcess, ExclusionExtension and
DisableRealtimeMonitoring (prefs); ThreatID, InitialDetectionTime,
ProcessName, Resources and ActionSuccess (detections).
Flags: real-time protection off; tamper protection off; AMRunningMode other
than Normal (for example passive) without a known reason; exclusions for
user, Temp or ProgramData folders, whole drives or powershell.exe;
detections with ActionSuccess False; old signatures. In the Defender log
(exported in section 10): 1116 malware detected, 5001 real-time protection
disabled, 5007 configuration changed, 5013 tamper protection blocked a
change. Do not start a scan now: it can remove the sample.

10. EVENT LOGS AND REGISTRY HIVES#

(ATT&CK T1685.001, T1685.005, T1112)
Event logs roll over, so export them, do not only query them.
  wevtutil gl Security > "$E\evt-security-config.txt"  # enabled, max size
  wevtutil gli Security > "$E\evt-security-info.txt"   # log status
  Get-WinEvent -ListLog * -ErrorAction SilentlyContinue |
    Select-Object LogName,RecordCount,IsLogFull,LastWriteTime |
    Export-Csv "$E\evt-loglist.csv" -NoTypeInformation
Export the logs that matter first (copies in .evtx, not text):
  foreach ($l in 'Security','System','Application',
    'Microsoft-Windows-PowerShell/Operational',
    'Microsoft-Windows-Windows Defender/Operational') {
    $f = Join-Path $E (($l -replace '[^A-Za-z0-9.-]','_') + '.evtx')
    wevtutil epl $l $f
  }
Then every other log that has records, into a subfolder:
  New-Item -ItemType Directory -Path "$E\evtx-all" -Force | Out-Null
  Get-WinEvent -ListLog * -ErrorAction SilentlyContinue |
    Where-Object RecordCount -gt 0 | ForEach-Object {
    $n = $_.LogName -replace '[^A-Za-z0-9.-]','_'
    wevtutil epl $_.LogName "$E\evtx-all\$n.evtx"
  }
Registry hives (reg save copies a loaded hive while Windows runs):
  foreach ($h in 'SYSTEM','SOFTWARE','SAM','SECURITY') {
    reg save "HKLM\$h" "$E\$h.hiv" /y
  }
  Get-ChildItem Registry::HKEY_USERS |
    Where-Object PSChildName -match '^S-1-5-21-[0-9-]+(_Classes)?$' |
    ForEach-Object {
    $s = $_.PSChildName
    reg save "HKU\$s" "$E\HKU_$s.hiv" /y
  }
The HKU loop saves the hives of users who are logged on now (NTUSER and
_Classes). Users who are logged off have no loaded hive: collect their
NTUSER.DAT with KAPE or from a disk image.
Warning: SAM and SECURITY copies hold local password hashes and LSA
secrets. ATT&CK lists "reg save HKLM\sam" as credential theft (T1003.002,
T1003.004), so your EDR may alert or block: tell the SOC first, and keep
the evidence drive encrypted.
Flags: Security log IsLogFull, or its oldest event newer than the incident
window (the log rolled over: check max size in wevtutil gl); 1102 "The
audit log was cleared" in Security; a log with enabled: false that should
be on; Defender or PowerShell logs empty on an active host.

11. SHADOW COPIES: LIST, NEVER DELETE (ATT&CK T1490)#

Inspect:
  vssadmin list shadows > "$E\vss-shadows.txt"
  vssadmin list shadowstorage > "$E\vss-storage.txt"
  Get-CimInstance Win32_ShadowCopy |
    Select-Object ID,InstallDate,VolumeName,DeviceObject,OriginatingMachine |
    Export-Csv "$E\vss-cim.csv" -NoTypeInformation
Older copies of locked files and of deleted data can survive here; KAPE
can read them. Do not create a new shadow copy on the suspect host: it
writes to the volume you are preserving.
Flags: no shadow copies where System Protection or backup software should
have made them; a very small storage limit; deletions shortly before
encryption (Ransomware Triage sheet).

12. HASH, CLOSE AND HAND OVER#

  Get-Date -Format o | Out-File "$E\end-time.txt"
  Stop-Transcript
  Get-ChildItem $E -Recurse -File | Get-FileHash -Algorithm SHA256 |
    Export-Csv "$E.sha256.csv" -NoTypeInformation
  Get-FileHash "$E.sha256.csv"                 # write this hash in notes
cmd.exe alternative, one file at a time:
  certutil -hashfile E:\IR\HOST1-20261017T081500Z\SYSTEM.hiv SHA256
The manifest is written NEXT TO the folder ($E.sha256.csv), so it does not
hash itself. Stop the transcript first so the files do not change after
hashing. Record who collected what and when, and every hand-over (chain of
custody: Incident Response sheet).

13. WMIC IS GONE: OLD PLAYBOOK LINES#

Microsoft deprecated WMIC in Windows 10 version 21H1 (2021). In January 2024
it was a preinstalled Feature on Demand on Windows 11 22H2 and 23H2. Since
the August 2026 update of the removed-features list, WMIC is removed from
Windows 11 version 24H2 and later and is no longer available as a Feature on
Demand. WMI itself is not affected. Older hosts (Windows 10, Server 2019 or
2022) may still have wmic.exe; do not rely on it. Windows PowerShell 2.0 is
removed too (Windows 11 24H2 since August 2025, Server 2025 since September
2025), so "powershell -Version 2" no longer works there.
  wmic process ...           ->  Get-CimInstance Win32_Process
  wmic service ...           ->  Get-CimInstance Win32_Service
  wmic shadowcopy ...        ->  Get-CimInstance Win32_ShadowCopy
  wmic useraccount ...       ->  Get-LocalUser (local accounts)

QUICK TRIAGE ORDER#

1. Agree the plan; decide on a memory image FIRST (Memory Forensics).
2. Section 3: evidence folder, transcript, UTC time, host clock offset.
3. Network: Get-NetTCPConnection, DNS cache, SMB sessions, netstat -ano.
4. Processes and services with command lines; hash and signature check.
5. Sessions, local users, Administrators (S-1-5-32-544).
6. Prefetch list and copy.
7. Scheduled tasks, Run keys, Defender status, preferences, detections.
8. Export event logs (.evtx), save the registry hives, list shadow copies.
9. Stop the transcript, hash the folder, record the manifest hash.
10. Only then contain (isolate, stop processes, disable accounts), and
    parse the copies offline (EZ Tools, KAPE, Chainsaw).

Commands, switches and properties checked against Microsoft Learn (Windows
Commands reference, Windows PowerShell 5.1 and Windows Server PowerShell
module references, WMI Win32_Process, Win32_Service and Win32_ShadowCopy,
Defender MSFT_Mp* classes and event IDs, well-known SIDs, the Windows
deprecated and removed features lists), RFC 3227 (BCP 55); technique IDs
per MITRE ATT&CK Enterprise v20. No Windows host was available: the
Windows-only commands were checked against the documentation, and the
PowerShell lines were syntax-checked with PowerShell 7.6.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.