scripting.rocksStart learning
CoursesPowerShellCyber Security
AVAILABLE NOW

Find the signal.
Keep the evidence.

PowerShell for Cyber Security. Turn logs and evidence into repeatable analysis, tested detections, and reports another analyst can follow.

16 lessons + a capstone About 4 hours In-browser labs

Recommended preparation: PowerShell: The Basics, or confidence with objects, pipelines, functions, files, and Pester. Every lesson is open to explore.

A little further, every lesson.

4 modules · 16 lessons · 1 capstone
01

Log analysis and indicators

Read event exports, define time windows, and find patterns worth investigating.

4 lessons
01Read a security event export12 min 02Put events in a UTC window12 min 03Find repeated failed logons12 min 04Match indicators precisely12 min
02

File integrity and evidence handling

Compare file hashes, preserve context, and search evidence as data.

4 lessons
05Build a file hash inventory12 min 06Compare a trusted baseline12 min 07Write a traceable evidence manifest12 min 08Search evidence as literal text12 min
03

Incident triage workflows

Connect process, network, identity, and timeline observations.

4 lessons
09Reconstruct process relationships12 min 10Add context to network observations12 min 11Review privileged access exports12 min 12Build an evidence timeline12 min
04

Defensive automation and reporting

Turn your analysis into tested functions and reproducible case reports.

4 lessons
13Turn a rule into a reusable detector15 min 14Distinguish no events from missing evidence12 min 15Publish a reviewable triage report12 min 16Test the boundary of a detection rule18 min
PUT IT ALL TOGETHER

Build a case reporting tool

Your capstone project · about 40 minutes

Open the capstone