Cheat Sheets

A living collection of quick reference snippets I reach for during triage, investigations, and lab work. Focused on what I actually use — not exhaustive man pages.

Networking

Fast recon and connectivity checks.

# Quick host discovery on a /24
nmap -sn 10.0.0.0/24

# Top 1000 TCP ports with service/version detection
nmap -sV -T4 <target>

# Full TCP sweep with default scripts + OS guess
nmap -sС -sV -O -p- <target>

# Show listening sockets with the owning process
ss -tulpn

# Follow a live connection to a suspicious IP
tcpdump -ni any host <ip> and not port 22

Linux

Triage-focused one-liners for a suspected compromise.

# Who is logged in, and from where
who; last -F | head

# Recently modified files in the last 24h (common webshell drops)
find /var/www /tmp /dev/shm -type f -mtime -1 2>/dev/null

# Persistence: cron, systemd, and rc files
crontab -l; ls -la /etc/cron.*; systemctl list-unit-files --state=enabled

# Processes ordered by CPU / memory
ps auxf --sort=-%cpu | head
ps auxf --sort=-%mem | head

# Auth failures and sudo usage
grep -E "Failed|sudo" /var/log/auth.log | tail -50

Windows

PowerShell for host inspection when I can't attach a full EDR view.

# Local users and group membership
Get-LocalUser; Get-LocalGroupMember -Group "Administrators"

# Running processes with parent PID (useful for LOLBin chains)
Get-CimInstance Win32_Process |
  Select ProcessId, ParentProcessId, Name, CommandLine

# Scheduled tasks not shipped by Microsoft
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" }

# Recent security events: 4624 logon, 4625 failed, 4688 process create
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4624,4625,4688 } -MaxEvents 50

# Persistence: autoruns-style registry keys
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run
Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run

SIEM Queries

KQL and Sigma-style fragments I keep on hand for common alerts.

// Suspicious PowerShell — encoded command or download cradle
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "FromBase64String", "IEX", "DownloadString")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

// Impossible travel: same user, two countries within 1h
SigninLogs
| summarize Countries = make_set(Location) by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(Countries) > 1

# Sigma — new local admin added
title: New Local Administrator Added
logsource: { product: windows, service: security }
detection:
  selection:
    EventID: 4732
    TargetUserName: 'Administrators'
  condition: selection
level: high

---

Living document — updated as I learn.