What a live Windows host reveals before it's ever imaged or its memory ever captured —
running processes, active connections, local accounts, and persistence mechanisms, pulled
straight from the command line while the system is still up. Organized by what each command
surfaces, why it's worth checking, what a suspicious value looks like, and exactly how to run it.
Click any card for why it matters, what a suspicious value looks like, its IOC type, and exactly how to run it.
Environment & Prerequisites
Before You Start
Before any command below returns something you can trust — confirm the session is elevated, PowerShell isn't blocking your tools, and the clock isn't already skewed against everything else in the case.
Set-ExecutionPolicy Bypass -Scope CurrentUser
Network Configuration
First Pass
What the host thought its network looked like, and what it was actually connected to — often two different answers.
ipconfig /all
Process & Service Enumeration
First Pass
What's actually running right now, matched up against what service or account is responsible for it.
tasklist /svc
User & Group Accounts
Second Pass
Who exists on this host, what they belong to, and what the current session is actually allowed to do.
net user
Scheduled Tasks & Persistence
Second Pass
The live-host counterpart to the Autopsy Field Guide's on-disk Registry, Email & EXIF category — the same persistence mechanisms, read straight off a running system instead of an image.
Get-ScheduledTask | Where-Object State -ne 'Disabled'
Log & Artifact Export
Preservation
Getting what you found off the live host and into the rest of the investigation, before the system is powered off or reimaged.