Cyber defense runs on the command line. The graphical interfaces are convenient, but the fastest, most precise and most scriptable way to investigate a system, trace a network, or detect a threat is still the terminal. Every security professional worth their salt builds a mental library of CLI commands that can be executed instantly in the heat of an investigation.
This guide collected the commands that matter most for day-to-day security work, organized by task, with both Linux and Windows equivalents where they differ. Treat it as a reference you can keep open on a second screen and as a syllabus for building your own muscle memory.
Why the command line matters in security
Speed is the first reason. When an alert fires, you do not have time to click through menus. A single command can show you every process, every open port, or the last thousand lines of the system log in less than a second.
Repeatability is the second reason. Commands can be chained, scripted, and automated, so a response that takes four manual steps becomes one script you rerun across dozens of systems. In a growing security landscape, that automation is what lets a small team cover a large estate effectively.
Transparency is the third. What a GUI hides, the command line reveals. You see exactly what you asked for, and no more, which matters when every second of investigation is a potential indicator of compromise.
Since cyber threats are now increasingly automated and adversarial systems move fast, defenders must move just as fast. The terminal is the tool that lets you keep pace.
Linux: system and process management
Before attacking a network, understand the machine in front of you. On Linux these commands form the base of observation.
Process introspection starts with pidof to find a process by name and htop or top for a live snapshot of CPU and memory. If you spot an unfamiliar process consuming resources, investigate ps aux to see the full command line that started it, and strace if you need to see what it is actually doing with system calls.
State monitoring uses uptime to see how long the system has been running, and free -h plus df -h to check memory and disk pressure. Sudden disk fills are a common early sign of malware writing data, so watch those numbers.
Service inspection relies on systemctl list-units on modern distros to see everything that is running and enabled. A service you did not install, enabled and active, is immediately suspicious and worth digging into with journalctl -u.
Windows: threat hunting in a familiar environment
Windows defenders reach for PowerShell and the native command suite. While the principles mirror Linux, the syntax differs and knowing the Windows equivalents avoids fumbling mid-response.
Process and service visibility starts with Get-Process, the PowerShell cousin of top, and Get-Service to list services and their states. For a sharper picture, tasklist shows processes with their memory use, and wmic is a classic tool for pulling detailed system data on older environments.
Log and registry analysis is where Windows differs most. Get-EventLog queries the event logs that record every login and critical action, while the registry, accessed through reg query, holds the autostart locations malware loves to abuse. Check zones like HKLM\Software\Microsoft\Windows\CurrentVersion\Run for unexpected persistence.
Network state is visible with netstat -ano, which lists connections, their local and remote addresses, and the owning process ID. A suspicious outbound connection to an unknown IP is exactly the kind of lead that starts an investigation.
Filesystem investigation and integrity checks
Attackers hide files in plain sight, and defenders need to see through that.
List directory trees with ls -laR on Linux or dir /s on Windows to expose hidden or nested files. Use find with mtime filters, as in find / -mtime -1, to surface recently modified files, a strong signal during an active incident.
Hashing is essential for integrity. Compute sha256sum (Linux) or Get-FileHash (PowerShell) on executables and compare the hashes against known-good values from your inventory or a trust database. Any mismatch means a file has been altered and warrants quarantine.
Look for unusual file extensions that do not match their apparent type, and for files stored where they should not be, such as scripts in temporary folders.
Network diagnosis and security audit
The network is where intrusions announce themselves, and several commands form your network toolkit.
Connection inspection uses netstat -tunap on Linux and netstat -ano on Windows to list everything from listening ports to established connections. Ports that should not be open, or connections to unfamiliar remote hosts, are immediate leads.
Traffic analysis starts with tcpdump on Linux or pktmon on Windows, which capture packets for deeper inspection. Combined with ngrep for payload searching, these tools let you see what the network actually carries rather than what it claims to carry.
The ARP table, read via arp -a, can reveal a poisoning on your LAN, a classic man-in-the-middle technique. Unexplained MAC address changes are your warning.
Remote access, tunneling, and secure transfer
When an investigation requires reaching another machine, encryption is non-negotiable.
SSH is the standard for secure remote access on Linux and is available on modern Windows too. Use scp for file transfer and ssh -L or ssh -D to build secure tunnels when you need to route traffic through a trusted jump host. These tools keep your remote work encrypted and your traffic protected from eavesdropping.
For Windows-native remote work, powershell remoting (Enter-PSSession) provides an encrypted alternative to legacy windows tools, letting you manage endpoints programmatically rather than one login dialog at a time.
When you rely on remote tools, guard your own access hygiene: use key-based authentication over passwords where possible, keep verbose logs of who connected and when, and never leave debug tunnels open longer than a task requires. The same commands that help you investigate are also a target for an inside adversary, so protect the credentials and the short-lived tunnels you use to move between systems.
Automation with Bash and PowerShell
The command line becomes truly powerful when you stop typing the same commands and start scripting them.
In Bash, a loop such as for host in $HOSTS; do ssh user@$host command; done runs an audit across an entire fleet in one pass. Functions and if conditionals let you write guards that only act when a condition is met, so a script can detect an anomaly and react differently for each host.
PowerShell brings the same power to Windows, with Get-Content to read logs line by line, conditionals to branch logic, and script blocks like ForEach-Object to process lists. A well-written powershell script turns a tedious multi-step Windows audit into a single reusable command.
Start small: automate one repeated task at a time, test on a safe host, then extend. The effort compounds quickly.
Frequently asked questions
Do I need to know both Linux and Windows? In a mixed enterprise, realistically yes, at least at the essentials level. You can be stronger in one, but a baseline in both makes you effective.
Are these commands safe to run on a live system? Mostly read-only commands are safe. Anything that stops services or deletes files should be run with care and only when you are certain of the target.
How do I keep building this skill set? Use the terminal for routine admin work instead of GUIs wherever possible. Repetition builds the muscle memory you need under pressure.
What about AI tools for security? AI can help you parse logs and summarize findings, but you must always verify a command before you run it, especially anything that modifies a system.
How do I remember these commands under stress? Build cheat sheets organized by task, not by command, and practice them in a lab environment until they are instinctive.
A worked example: tracing a suspicious process
Bring the pieces together with a realistic scenario. An analyst receives an alert about an unknown process consuming CPU on a Linux server. The investigation flows through a few connected commands.
First, confirm what is running: top reveals a process mysteriously named "update", and pidof update gives its id. Then ps aux shows the full command line, revealing a surprising launch path in a temporary directory. That alone is suspicious.
Next, trace the network: netstat -tunap lists connections opened by that process, exposing a connected remote address on an uncommon port. arp -a confirms nothing odd on the local network, so the lead points outward. A packet capture with tcpdump and a filter on that port shows a steady stream of outbound data, indicating exfiltration rather than a harmless update.
Finally, check the filesystem: find / -mtime -1 surfaces recently modified files, and sha256sum of the suspicious binary differs from the known-good copy in your integrity inventory. The picture is complete, and the team proceeds to contain the host and pull the indicators for signatures.
Each step relied on one or two standard commands, connected by judgment. That is how the command line becomes an investigation rather than a collection of tools.
Building your own investigation cheat sheet
A cheat sheet organized by situation is more useful than a random list. Group commands by the questions they answer: "what is running here?", "where are the connections going?", "what changed recently?", and "who logged in?".
For each question, note one or two commands you know well, with the key flags written out, and a short note on what a suspicious answer looks like. Keep it on a second screen during live work. Over time, as you act on the answers and see real outcomes, the cheat sheet becomes a learning log of your experience rather than a static reference.
Setting up a safe practice environment
None of this skill should be practiced against production systems until you are confident. Set up a virtual lab with copies of the operating systems you need, install a deliberately vulnerable machine, and practice your full investigation workflow against a simulated incident.
A good practice routine is to create a fake alert, then time yourself walking through the commands: identify the process, trace the network connection, find the modified file, and write a brief report. The ability to do this smoothly under a timer is a much better measure of readiness than being able to recite the syntax of a command in isolation.
This prepared calm is exactly what lets you act quickly and correctly when a real incident arrives, because the fundamentals are already muscle memory.
The discipline of documentation
Investigations produce findings that most teams never write down, and that is a missed opportunity. Record every investigation with a short note: what was asked, what commands you ran, what you found, and what you concluded.
Over time this log becomes invaluable. It helps you recognize which anomalies are normal for your environment, spot emerging patterns, and hand off work cleanly to teammates. It also turns each investigation into a teaching case that improves your whole team, not just your own response.
Good documentation is not bureaucracy; it is the difference between a reaction and an operation.
Living in a blended, automated workflow
The most effective defenders blend manual command skill with automation. Use the terminal to understand a single system quickly, then wrap that understanding into a script that checks a hundred systems the same way.
A realistic pattern is to start a personal response with a handful of manual commands to get the lay of the land, and then, once you know what to look for, deploy a script that sweeps the fleet for the same indicators. Your manual skill keeps you precise when the situation is ambiguous, and your scripting extends that precision across the whole estate.
Final thoughts
The command line is the security practitioner's most dependable instrument. Master the core commands for inspecting processes, files, networks, and logs, learn the Windows equivalents, and wrap the repetitive parts in scripts. With these skills you can investigate quickly, respond precisely, and scale your coverage. And as the tooling grows more automated, the human ability to read a log, connect a pattern, and decide what to run next becomes more valuable, not less.
