## PowerShell

The most powerful tool in Windows. It is an Object-Oriented shell.
(`cmd.exe` is text-based. `powershell.exe` handles Objects).

### Cmdlets (Command-lets)
They follow `Verb-Noun` syntax.
*   `Get-Process`: List processes.
*   `Stop-Service`: Stop a service.
*   `New-Item`: Create a file.

### Aliases
Shortcuts for Linux users.
*   `ls` -> `Get-ChildItem`
*   `cat` -> `Get-Content`
*   `wget` -> `Invoke-WebRequest`

### The Pipeline `|`
Passes objects.
*   `Get-Process | Sort-Object CPU -Descending | Select-Object -First 5`
    *   Get all processes.
    *   Sort them by CPU usage.
    *   Show only top 5.

### PowerShell for Hackers
*   **Fileless Malware**: Running a script strictly in memory (RAM). No file touches the disk, so Antivirus often misses it.
*   **Execution Policy**: A safety feature, not security.
    *   `Set-ExecutionPolicy Bypass`: Ignores the restrictions.
*   **Logging**: Script Block Logging (Event 4104) is the only way to catch malicious PowerShell.