ConceptsCommand Line

Command Line

The text-based interface for issuing commands to an operating system, and a rich source of security evidence: the full command line of a process often reveals exactly what it was doing, which is invaluable for detection and investigation.

Glossary definition

14 direct links6 lessons

Concept Neighborhood

Explore this concept’s connections in the groups below.

PrerequisiteRelated

Start here

Sysmon

A related concept to explore, covered by 8 lessons.

Open concept →

Builds towardCommand Line is a foundation for these

CMD Detection

Detecting suspicious use of the Windows command shell (cmd.exe), such as commands spawned by unexpected parents or running reconnaissance and download activity, since attackers heavily abuse built-in command-line tools.

lessons

Relatedsorted by lesson coverage

SysmonStart here

lessons

Executable Path

lessons

Parent Process

lessons

Process

lessons

Process Tree

lessons

LOLBin Detection

lessons

Show 7 more connections

PowerShell Detection

lessons

Scheduled Task Detection

lessons

Execution

lessons

Bash History

lesson

Crontab

lesson

DLL Search Order Hijacking

lesson

Shell

lesson

Related Lessons

6 lessons cover this concept

Processes, Users, and the Idea of Security Context

General Beginner

Windows Essentials for Defenders

General Beginner

Linux Essentials for Defenders

General Beginner

Privilege Escalation on Both Platforms

General Beginner

Persistence: Long-Term Attacker Footholds

General Beginner

Reading Endpoint Evidence Like a Defender

General Beginner