Complete Windows & Linux Command Reference for SOC Analysts (With

Syntax & Examples)

This document contains an extensive list of Windows CMD, PowerShell, and Linux
commands used by SOC Analysts for monitoring, investigation, threat hunting, incident
response, forensics, persistence detection, and malware analysis.

SECTION 1: WINDOWS COMMANDS (CMD + PowerShell)

1. System Enumeration
 Command: Hostname

Syntax: hostname

Example: hostname

 Command: Current User

Syntax: whoami

Example: whoami

 Command: Detailed User Info

Syntax: whoami /all

Example: whoami /all

 Command: System Information

Syntax: systeminfo

Example: systeminfo

 Command: Environment Variables

Syntax: set

Example: set
 Command: OS Version

Syntax: ver

Example: ver

 Command: Installed Patches

Syntax: wmic qfe list

Example: wmic qfe list brief

 Command: BIOS Info

Syntax: wmic bios get serialnumber

Example: wmic bios get serialnumber

2. User & Group Investigation

 Command: List Users

Syntax: net user

Example: net user

 Command: User Details

Syntax: net user <username>

Example: net user john

 Command: Local Groups

Syntax: net localgroup

Example: net localgroup

 Command: Administrators Group

Syntax: net localgroup administrators

Example: net localgroup administrators

 Command: Account Policies

Syntax: net accounts

Example: net accounts

 Command: Logged In Users

Syntax: query user

Example: query user

3. Process & Services

 Command: Running Processes

Syntax: tasklist

Example: tasklist

 Command: Processes with Services

Syntax: tasklist /svc

Example: tasklist /svc

 Command: Kill Process

Syntax: taskkill /PID <pid> /F

Example: taskkill /PID 1234 /F

 Command: Service Status

Syntax: sc query
Example: sc query

 Command: Service Details

Syntax: sc qc <service>

Example: sc qc WinDefend

 Command: List Drivers

Syntax: driverquery

Example: driverquery /v

4. Network Investigation
 Command: IP Configuration

Syntax: ipconfig /all

Example: ipconfig /all

 Command: DNS Cache

Syntax: ipconfig /displaydns

Example: ipconfig /displaydns

 Command: Active Connections

Syntax: netstat -ano

Example: netstat -ano

 Command: Connections + Executable

Syntax: netstat -anob

Example: netstat -anob

 Command: ARP Table

Syntax: arp -a

Example: arp -a

 Command: Routing Table

Syntax: route print

Example: route print

 Command: NSLookup

Syntax: nslookup <domain>

Example: nslookup [Link]

 Command: Ping

Syntax: ping <host>

Example: ping [Link]

 Command: Trace Route

Syntax: tracert <host>

Example: tracert [Link]

 Command: Shared Folders

Syntax: net share

Example: net share

5. File System & Permissions
 Command: List Files

Syntax: dir /a

Example: dir /a

 Command: Tree View

Syntax: tree

Example: tree C:\

 Command: View File

Syntax: type <file>

Example: type [Link]

 Command: File Attributes

Syntax: attrib

Example: attrib [Link]

 Command: File Permissions

Syntax: icacls <path>

Example: icacls C:\Users

 Command: Take Ownership

Syntax: takeown /f <file>

Example: takeown /f C:\[Link]

6. Event Logs
 Command: List Logs
Syntax: wevtutil el

Example: wevtutil el

 Command: Query Security Log

Syntax: wevtutil qe Security

Example: wevtutil qe Security /c:10 /f:text

 Command: Audit Policy

Syntax: auditpol /get /category:*

Example: auditpol /get /category:*

 Command: Open Event Viewer

Syntax: eventvwr

Example: eventvwr

7. Persistence Checks
 Command: Scheduled Tasks

Syntax: schtasks /query /fo LIST /v

Example: schtasks /query /fo LIST /v

 Command: Startup Programs

Syntax: wmic startup get caption,command

Example: wmic startup get caption,command

 Command: Registry Run Key

Syntax: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Example: reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

8. PowerShell Investigation
 Command: List Processes

Syntax: Get-Process

Example: Get-Process

 Command: List Services

Syntax: Get-Service

Example: Get-Service

 Command: Security Events

Syntax: Get-WinEvent -LogName Security -MaxEvents 20

Example: Get-WinEvent -LogName Security -MaxEvents 20

 Command: TCP Connections

Syntax: Get-NetTCPConnection

Example: Get-NetTCPConnection

 Command: File Hash

Syntax: Get-FileHash <file>

Example: Get-FileHash C:\[Link]

 Command: Local Users

Syntax: Get-LocalUser

Example: Get-LocalUser
SECTION 2: LINUX COMMANDS

1. System Enumeration
 Command: Hostname

Syntax: hostname

Example: hostname

 Command: Current User

Syntax: whoami

Example: whoami

 Command: Kernel Info

Syntax: uname -a

Example: uname -a

 Command: Uptime

Syntax: uptime

Example: uptime

 Command: OS Info

Syntax: cat /etc/os-release

Example: cat /etc/os-release

2. User & Login Investigation

 Command: All Users

Syntax: cat /etc/passwd

Example: cat /etc/passwd

 Command: Logged In Users

Syntax: who

Example: who

 Command: Login History

Syntax: last

Example: last

 Command: Failed Logins

Syntax: lastb

Example: sudo lastb

 Command: User ID Info

Syntax: id <user>

Example: id john

3. Process Monitoring
 Command: All Processes

Syntax: ps aux

Example: ps aux

 Command: Top Processes

Syntax: top

Example: top
 Command: Process Tree

Syntax: pstree

Example: pstree

 Command: Kill Process

Syntax: kill -9 <PID>

Example: kill -9 1234

4. Network Investigation
 Command: IP Address

Syntax: ip a

Example: ip a

 Command: Routing Table

Syntax: ip route

Example: ip route

 Command: Active Connections

Syntax: ss -tulnp

Example: ss -tulnp

 Command: Netstat

Syntax: netstat -tulnp

Example: netstat -tulnp

 Command: Ping
Syntax: ping <host>

Example: ping [Link]

 Command: Traceroute

Syntax: traceroute <host>

Example: traceroute [Link]

 Command: DNS Query

Syntax: dig <domain>

Example: dig [Link]

5. File System & Permissions

 Command: List Files

Syntax: ls -la

Example: ls -la

 Command: Change Directory

Syntax: cd <path>

Example: cd /var/log

 Command: View File

Syntax: cat <file>

Example: cat [Link]

 Command: Search Text

Syntax: grep <keyword> <file>

Example: grep root [Link]

 Command: Find Files

Syntax: find / -name <name>

Example: find / -name [Link]

 Command: Change Permissions

Syntax: chmod 755 <file>

Example: chmod 755 [Link]

 Command: Change Ownership

Syntax: chown user:group <file>

Example: chown root:root [Link]

6. Logs & Services

 Command: Auth Logs

Syntax: cat /var/log/[Link]

Example: cat /var/log/[Link]

 Command: Live Logs

Syntax: tail -f <log>

Example: tail -f /var/log/[Link]

 Command: Journal Logs

Syntax: journalctl -xe

Example: journalctl -xe

 Command: Service Status

Syntax: systemctl status <service>

Example: systemctl status ssh

 Command: List Timers

Syntax: systemctl list-timers

Example: systemctl list-timers

7. Persistence & Cron

 Command: User Cron Jobs

Syntax: crontab -l

Example: crontab -l

 Command: System Cron

Syntax: cat /etc/crontab

Example: cat /etc/crontab

8. File Integrity & Analysis

 Command: MD5 Hash

Syntax: md5sum <file>

Example: md5sum [Link]

 Command: SHA256 Hash

Syntax: sha256sum <file>

Example: sha256sum [Link]

 Command: File Type

Syntax: file <file>

Example: file [Link]

 Command: Extract Strings

Syntax: strings <file>

Example: strings [Link]

 Command: Open Files by Process

Syntax: lsof -i

Example: lsof -i
SOC Practice Recommendations
• Practice all commands inside a controlled lab (VirtualBox/VMware).

• Correlate process + network + logs during investigations.

• Simulate brute-force, malware, persistence, and lateral movement scenarios.

• Document findings like a professional SOC incident report.