Commandes de collecte

Commandes rapides, requêtes SIEM et playbooks synthétiques pour le triage quotidien.

Windows

Get-Date -Format o
hostname
whoami /all
Get-Process | Sort CPU -Descending
Get-NetTCPConnection
Get-ScheduledTask
Get-CimInstance Win32_StartupCommand
Get-LocalUser
Get-LocalGroupMember Administrators
Get-WinEvent -LogName Security -MaxEvents 100

Linux

date -u --iso-8601=seconds
hostnamectl
id
ps auxfww
ss -plant
lsof -nP -i
systemctl list-unit-files --state=enabled
systemctl list-timers --all
last -Faiwx
journalctl -p warning..emerg --since '-24 hours'

Hash et métadonnées

sha256sum evidence.bin
stat evidence.bin
file evidence.bin
exiftool evidence.bin

Get-FileHash .\evidence.bin -Algorithm SHA256
Get-Item .\evidence.bin | Format-List *

Réseau

tshark -r capture.pcapng -q -z endpoints,ip
nmap -sn 192.0.2.0/24 -oA discovery