> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/windows-quick-tips/windows-command-line.md).

# Windows Command Line

* **System Information and Configuration:**
  * `systeminfo`: Provides detailed information about the system, including OS version, patches, and system uptime.
  * `netstat -ano`: Lists all ports that are currently open and the corresponding process IDs. Useful for identifying unexpected network connections.
  * `ipconfig /all`: Displays all network configuration details, including IP addresses, DNS servers, and MAC addresses.
  * `tasklist`: Shows all currently running processes, which is vital for identifying suspicious activity.
  * `sc query`: Lists the status of all services. This can help identify unauthorized or rogue services.
  * `driverquery`: Lists all installed drivers, useful for finding hidden or malicious drivers.
* **User Account and Login Information:**
  * `net users`: Lists all user accounts on the system.
  * `quser`: Displays information about logged on users.
  * `net user [username]`: Provides detailed information about a specific user account.
  * `wevtutil qe Security /f:text /rd:true /c:10`: Queries the Security event log for the last 10 entries, which can include logon events.
* **File and Directory Analysis:**
  * `dir /a /s /b`: Lists all files and directories, including hidden ones. Useful for a quick directory traversal.
  * `fc /b [file1] [file2]`: Compares two files byte-by-byte, which can be useful for checking file integrity.
  * `findstr /s /i [string] *.*`: Searches for a string in all files, helpful for finding specific content.
* **Network Configuration and Analysis:**
  * `route print`: Displays the current routing table, which can reveal unexpected routes.
  * `arp -a`: Shows the ARP table, useful for identifying local network devices.
  * `nslookup`: A tool for querying DNS to resolve hostnames to IP addresses and vice versa.
* **Forensic Tools:**
  * `powershell "Get-WinEvent -ListLog *"`: Lists all event logs, useful for identifying available logs for deeper analysis.
  * `wmic process list full`: Provides comprehensive information about running processes, including their execution path, which can reveal malicious processes.
  * `vssadmin list shadows`: Lists Volume Shadow Copies, which can contain backups of critical files or evidence of tampering.
* **Miscellaneous:**
  * `sfc /scannow`: Scans and verifies the integrity of all protected system files.
  * `chkdsk`: Checks the file system and file system metadata for logical and physical errors.
  * `gpresult /H gpresult.html`: Generates a report of group policy settings, which can help identify unauthorized changes.