Method

• Check the PowerShell history

  Get the location of the history file:

  Get-PsReadlineOption

Default location

`$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt`

Read the history file (default location):

type C:\Users\%username%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

Read from the Get-PsReadlineOption command

type (Get-PsReadlineOption).HistorySavePath

• Get the system locale if the language is different from what you know

  Get-WinSystemLocale

• Get the user's Privileges and Groups

  whoami /all

  Some Privileges to look out for are

• SeBackupPrivilege

• SeRestorePrivilege

• SeImpersonatePrivilege

  Also look for the user being a part of any interesting groups such as

• Administrators

• Domain Administrators

• Get a list of users

  net user

• Check for interesting groups

  net localgroup

• See who is in the interesting groups such as Administrators

  net localgroup Administrators

  net group "Domain Administrators" /domain

• Get the system information

  systeminfo

• Get a list of running processes

  tasklist /V

• Get network information

  ipconfig /all

  route print

  netstat -nao | findstr /i "listen"

• Firewall Status and Rules

  netsh advfirewall show currentprofile

  netsh advfirewall show rule all

• Look at scheduled tasks

  schtasks /query /fo LIST /v