11 Windows Security Commands for SOC Analysts and What to Look For

In cybersecurity, real-time detection and response require precise tools. This blog covers 11 essential Windows security commands that are vital for SOC analysts, ethical hackers, and IT professionals. From monitoring logged-in users and network connections to viewing firewall rules and initiating malware scans, these built-in commands help streamline threat hunting, incident response, and system hardening. Learn how to use each command effectively, their practical use cases, and why mastering them is important for security success in 2026.

Jun 16, 2025 - 10:08

Updated: 17 days ago

104.8k

11 Windows Security Commands for SOC Analysts and What to Look For

Quick answer: Eleven Windows commands useful in SOC triage are: net user, query user, netsh advfirewall, Get-HotFix (or wmic qfe), tasklist /svc, Event Viewer or Get-WinEvent, secpol.msc, resmon, netstat -ano, a Defender scan with MpCmdRun or Start-MpScan, and whoami /groups. Each answers a question: who is here, what is running, what is listening, what changed.

Key takeaways

Run commands from an elevated prompt on systems you are authorised to investigate. Record what you ran and when.
wmic is deprecated and missing on newer Windows 11 builds. Use PowerShell (Get-HotFix, Get-CimInstance) instead.
netsh advfirewall show allprofiles shows profile settings, not individual rules. Use netsh advfirewall firewall show rule name=all for rules.
Commands give a snapshot. They can be fooled by rootkits, so compare with EDR and logs.
Know key event IDs: 4624, 4625, 4688, 4720, 4732 and 1102.

Why use built-in Windows commands in a SOC?

EDR and SIEM tools are the main instruments, but built-in commands need no installation, work over remote shells, and let you check a host quickly during triage. They also teach what the tools collect. Use them only on systems you are authorised to examine, from an elevated prompt, and note each command and time for your case record.

The 11 commands

#	Command	Question it answers	What to look for
1	`net user`	Which local accounts exist?	Unknown or recently created accounts, names that mimic admin accounts
2	`query user`	Who is logged on, and how?	Unexpected remote sessions, disconnected admin sessions
3	`netsh advfirewall show allprofiles`	Is the firewall on for each profile?	Profiles turned off, inbound default set to allow
4	`Get-HotFix` (older: `wmic qfe list`)	What patches are installed?	Missing recent updates, no updates for months
5	`tasklist /svc` or `services.msc`	What processes and services are running?	Odd service names, services running from user or temp folders
6	`eventvwr.msc` or `Get-WinEvent`	What does the log say?	Failed logons, new accounts, cleared logs, new services
7	`secpol.msc`	What local security policy applies?	Weak password or lockout settings, audit policy not enabled
8	`resmon`	Which process uses CPU, disk and network?	Unknown processes with heavy network use
9	`netstat -ano`	What is listening and connected, and which PID owns it?	Unexpected listeners and outbound connections to unknown IPs
10	`MpCmdRun.exe -Scan -ScanType 2` or `Start-MpScan -ScanType FullScan`	Does Microsoft Defender find malware?	Detections; also scan results are logged
11	`whoami /groups`	What privileges does this account have?	Membership in Administrators or other powerful groups

How do you use them together?

Check connections and the process behind them

netstat -ano | findstr ESTABLISHED
tasklist /svc /fi "PID eq 4321"
Get-Process -Id 4321 | Select-Object Name, Path, StartTime

Take the PID from netstat, then identify the process and its path. A process in a user's temporary folder talking to an unfamiliar address is worth escalating. Illustrative output line: TCP 10.0.0.5:51234 203.0.113.9:443 ESTABLISHED 4321 (a documentation-range example address).

Check accounts and privileged groups

net user
net localgroup administrators
whoami /groups

Check patches

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

The wmic tool is deprecated and is no longer installed by default on newer Windows 11 builds. PowerShell works everywhere you need it.

Check the firewall properly

netsh advfirewall show allprofiles
netsh advfirewall firewall show rule name=all dir=in

The first command shows whether each profile is on and its default actions. The second lists the rules. PowerShell offers Get-NetFirewallRule.

Check logs for key events

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

Event ID	Meaning
4624	Successful logon (check logon type)
4625	Failed logon (look for bursts)
4688	New process created (needs auditing enabled)
4720	User account created
4732	Member added to a local security group
1102	Security log cleared
7045	New service installed (System log)

What are the limits of command-line triage?

It is a snapshot, so short-lived connections are missed.
Malware with admin rights can hide processes, ports and files from standard tools.
Running tools on a live system changes it. Collect volatile data first where the case needs it, and use forensic tooling for evidence.
Output without context proves nothing. Compare against a baseline for that host.

Best practices

Use a trusted copy of tools or known-good shells when you suspect compromise.
Save output to a file with a timestamp and hash it.
Do not change settings during triage unless containment requires it.
Escalate with evidence: command, output, time and host.
Turn recurring checks into SIEM or EDR detections.

Next steps

To practise these on lab machines, see WebAsha's SOC training. For the wider command list, read 70 essential Windows CMD commands.

Frequently Asked Questions

They require no installation, work over remote shells and give quick visibility into accounts, processes, network connections, patches and logs during triage. They complement, not replace, EDR and SIEM tools.

WMIC is deprecated and is not installed by default on newer Windows 11 builds. Use PowerShell instead, for example Get-HotFix for patches or Get-CimInstance for system information.

Run netstat -ano to list connections with process IDs, then use tasklist /svc /fi "PID eq " or Get-Process -Id to identify the process and its path.

Important ones include 4624 successful logon, 4625 failed logon, 4688 process creation, 4720 account created, 4732 group membership change, 1102 security log cleared and 7045 service installed.

No. It shows the state and default settings for each profile. To list rules, use netsh advfirewall firewall show rule name=all or the PowerShell cmdlet Get-NetFirewallRule.

No. They give a snapshot and can be evaded by malware with administrative control. Use them with EDR, SIEM logs and forensic tooling, and compare results to a baseline for the host.

Interested in this course? Get a callback from our experts.

Tags:

Top Password Cracking Tools for Ethical Hackers and Security Teams

What's Your Reaction?

Like 0

Dislike 0

Love 0

Funny 0

Wow 0

Sad 0

Angry 0

Vaishnavi

Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.