Cybersecurity Analyst Pt 3 - SOC100 - PowerShell, Intro to Linux, History, Architecture, Basic CLI

Main ideas, concepts, and lessons

1) Intro to PowerShell vs CMD (Windows)

• The session begins by introducing a guest instructor, James, who contributes to the SOC100 course and is focused on Linux and pentesting/red teaming.
• The instructors recap that CMD (Command Prompt) was the classic, old-school terminal (MS-DOS style), and PowerShell is Microsoft’s modern replacement aimed at:
  • Administration and automation
  • Direct interaction with Windows/framework components (e.g., .NET, Active Directory, servers)

Key conceptual differences

• Scripting vs compiled languages
  • PowerShell is presented as a scripting language (typically interpreted line-by-line).
• Verb-Noun syntax in PowerShell
  • Examples: Get-Location (instead of Linux/CMD-style abbreviations like cd)
• Objects instead of raw text
  • CMD output is more like “formatted text”.
  • PowerShell output is structured as objects with properties (e.g., LastWriteTime, Length, etc.).
• Aliases and compatibility
  • Some commands may look similar or overlap (e.g., dir works in PowerShell), but PowerShell can map or enforce different commandlets—so it’s not always 1:1.

---

2) Understanding errors and help in PowerShell

• A demonstration command like get groceries triggers a verbose PowerShell error.
• Lesson: PowerShell errors can be long and detailed; students should learn to parse them.

PowerShell help workflow

• Use Get-Help and tab completion to find correct commandlet syntax.
• PowerShell parameters are shown as options (e.g., a -Path option with a value like C:\Users).

---

3) Piping, filtering, and object processing

Main PowerShell operators/tools

• Pipeline (|): feed the output of one command into another.
• Where-Object:
  • Filters object streams by property comparisons.
  • Example concept: Get-Process | Where-Object { $_.ProcessName -eq "notepad" }

Lesson

• Variables/properties help you work with runtime data cleanly.
• The pipeline enables powerful querying.

---

4) PowerShell safety and permissions guidance

• A chat question asks whether PowerShell is safe.
• Instructor guidance:
  • PowerShell is powerful and can be abused (reverse shells, keyloggers, malware delivery).
• Recommended operational security:
  • Only enable PowerShell where needed.
  • Restrict usage—potentially to privileged admin roles (the instructor emphasizes domain admins).
  • Prefer running it on controlled systems (students should experiment on VMs/home labs).

---

5) Scripting in PowerShell and CMD (automation)

PowerShell scripting

• The video demonstrates the PowerShell Integrated Scripting Environment (ISE) using .ps1 scripts.
• Script structure basics:
  • Comments
    • # for single-line
    • <# #> for multi-line
  • Variables using $ notation.
• Example script outcome:
  • Creates a user account
  • Sets password and description/comment
  • Adds the user to the Administrators group

CMD batch scripting

• Example .bat scripts use command-line utilities like net user and net localgroup.
• Batch conventions:
  • @echo off to suppress output
  • pause to keep the window open
  • REM or :: for comments

Lesson

• Scripting is about bundling known commands into repeatable sequences for faster automation.

---

6) SOC100-style challenge guidance (scripting practice)

Students are prompted to complete challenges such as:

• In Windows/PowerShell (and optionally batch):
  • Find files larger than 5MB in C:\
  • Save the list to large files.txt
• Optional enhancements:
  • Sort by size
  • Implement in both PowerShell and batch if desired

Tools for learning

• Use ss64 for Windows command references.
• Ask questions in the Discord channel.
• Use documentation and targeted search (avoid asking AI for direct answers).

---

Linux section: history, architecture, and practical orientation

7) Linux origins and why it differs from Windows

Short history timeline

• Richard Stallman and the Free Software Foundation (free/open Unix-like goals)
• The GNU project development
• Linus Torvalds developing the Linux kernel

“GNU/Linux” naming explained

• GNU tools + Linux kernel form a Unix-like environment—hence the combined naming.

---

8) Linux vs Windows: architecture and trade-offs

Core architectural differences

• Windows tends to separate kernel/user space more strongly, improving stability but sometimes requiring restarts for changes.
• Linux has more direct interaction between kernel and loaded modules/drivers, which can lead to “kernel panic” risks.

Filesystem philosophy

• Linux has no registry.
• “Everything is a file” (or exposed via file-like interfaces).
• Configuration is typically stored in text files under locations like /etc.

Filesystem structure highlights

• / root directory
• /bin binaries/commands
• /etc configuration files
• /home per-user directories
• /proc virtual filesystem exposing running process information
• /dev device files
• /var logs/variable data/temp
• /mnt mount points, /opt optional software

---

9) Distributions (distros) and examples

Distro concept

• A distro is: Linux + packaging + defaults + tools + possibly a desktop environment.

Examples mentioned

• Ubuntu, Debian, Arch, Fedora, Linux Mint
• Kali Linux
  • Debian-based with pre-installed pentesting tools
• Asahi Linux
  • Mentioned for Apple Silicon compatibility

Lesson

• You can customize by building on other distros; “your own distro” is possible.

---

10) Unix philosophy as a Linux operating principle

Three principles emphasized:

• Build programs that do one thing well
• Programs should work together
• Programs should handle text streams (universal interface)

Consequence

• Linux command-line tools compose naturally with pipes and consistent flag patterns.
• Contrasted with Windows “one tool, one job” style.

---

11) Linux permissions and elevation

• Permissions were presented as simpler than Windows’ granular, GUI-heavy security.
• Linux often uses read/write/execute semantics.

Elevation concept

• Use sudo / su.
• Emphasis:
  • Elevate temporarily for privileged actions.
  • Not everything is meant for normal users.

---

Linux GUI (xfce) labs and navigation

12) XFCE desktop basics (mouse-friendly entry point)

Students learn the desktop environment:

• Applications menu (launch apps)
• File explorer / “places” (home directory browser)
• Trash behavior (move to trash, recover, empty trash)
• Settings menu (display, network/VPN/proxy)
• Search within settings

Key UI navigation lessons

• Home directory is per-user and typically where user folders live.
• Desktop is a subfolder within the user home (illustrated by creating/deleting a test folder).

---

13) GUI file system map reinforcement

• GUI demonstration reinforces: file system = folders inside folders
• Examples shown:
  • Opening / (root directory)
  • Browsing system folders like /bin, /etc, /home, /dev, /proc, /mnt, /opt, /var

Permissions reinforcement

• Root-owned areas may be inaccessible without elevated privileges.

---

Linux system monitoring labs (GUI)

14) “System Monitor” (process/resources/file systems)

• System Monitor is explained as Linux’s analog to Windows Task Manager + more depth:
  • Real-time processes list
  • CPU/memory/disk usage graphs
  • File system usage by device
• Demonstration flow:
  • Open a GUI app (mousepad/editor)
  • Find it in the process list
  • Stop/kill or observe behavior
• Lesson: Knowing what consumes resources helps diagnose “computer slow/crashes” problems.

---

15) “Log Viewer”

Log Viewer helps review system events:

• Application logs (software start/stop/errors)
• System logs (kernel/boot/auth activity)
• Security logs (firewall/auth/unauthorized attempts)
• Hardware logs (device disconnect/reconnect issues)

Lesson

• Searching logs by keyword helps locate what happened and when (e.g., cron-related activity, user session events).

---

16) “Task Manager” (simpler overview)

• Task manager is described as a quick diagnostic tool:
  • Shows running processes and colored status indicators (starting/terminating)
  • Allows terminating processes (less depth than System Monitor)

---

Linux CLI lab: core commands and workflow

17) Terminal environment and multitasking

• Gnome terminal basics:
  • Multiple terminal tabs/windows can run simultaneously
  • Tabs can be switched; new terminals opened with keyboard shortcuts

Lesson

• CLI workflows are faster when you keep multiple sessions open.

---

18) Core identity and environment commands

Commands introduced:

• whoami
• who am I
• id and sudo whoami/sudo id concept:
  • Demonstrates context changes when running with elevated privileges.

Navigation helpers:

• pwd (print working directory)
• ls for listing contents

---

19) ls flags and documentation workflow

ls variants/options covered:

• ls (basic)
• ls -a (shows hidden files starting with .)
• ls -l (long listing with permissions, owner, size, timestamps)
• ls -t (sort by modified time)
• Combined examples:
  • ls -la
  • ls -ltr (idea of combining options)

Man pages

• Use man ls to read authoritative documentation.

Lesson

• Use a repeatable pattern: check man when unsure.

---

20) Changing directories and paths (relative vs absolute)

• cd used for navigation:
  • cd .. to move up one level
  • cd <folder> to move relative to current directory
  • cd / to go to root

Relative vs absolute

• Relative depends on your current directory.
• Absolute begins with / and can jump anywhere directly.

---

Detailed methodology / instruction lists mentioned

A) How to get PowerShell help (method)

• Use the Get-Help commandlet:
  • Get-Help <commandlet>
• Use tab completion to discover valid parameters and syntax.
• When parameter errors appear, parse the error fields such as:
  • “Not recognized…”
  • Line/character position
  • “Try to recover” / verbosity clues

---

B) PowerShell object filtering workflow (method)

Conceptual steps:

1. Run a command that returns structured objects (e.g., Get-Process)
2. Pipe output into Where-Object
3. Filter by an object property (e.g., ProcessName)

Example pattern:

• Get-Process | Where-Object { $_.ProcessName -eq "notepad" }

---

C) How to create and use scripts (PowerShell and CMD)

PowerShell

• Use .ps1 scripts executed via the PowerShell environment (or ISE “run”).
• Save the script, review comments/variables, and run with appropriate privileges if needed.

CMD

• Create a .bat file containing command-line statements.
• Batch conventions:
  • @echo off
  • pause
  • REM or :: comments
• Run the .bat as administrator when performing privileged tasks.

---

D) Linux CLI navigation workflow (method)

• Identify identity/context:
  • whoami, who am I, id
  • Use sudo to compare results under elevated context
• Navigate filesystem:
  • pwd
  • ls with flags (-a, -l, -t)
  • cd, cd .., cd /
• Use documentation when stuck:
  • man <command>

---

E) Linux file system mental model (method)

Build a mental map anchored on:

• / (root directory)
• ~ / /home/<user> (home)
• Virtual file systems:
  • /proc for process info
  • /dev for device files

Remember:

• “Folders inside folders; files inside folders”
• Linux “everything is a file” (especially via /proc and /dev)

---

Speakers / sources featured

1. James (guest instructor; SOC100 contributing instructor; Linux-focused; pentesting/red teaming oriented)
2. Anthony (host/instructor who leads comparisons, labs, and transitions between Windows and Linux)
3. Chat participants (names/statuses appear in subtitles; not formal speakers, contribute questions/feedback like “Kim,” “Karina,” “KSJ/KS,” “Steven,” “DOS/edu,” “Zeno,” etc.)
4. SOC100 course (source referenced for labs/challenges/content)
5. ss64 (Windows/CMD command reference website)
6. ExplainShell (Linux command help reference)
7. Arch Linux Wiki (major documentation resource)
8. ds64/other distrowatch-like resources (distro info website referenced; exact name partially unclear in subtitles)