Operator On The Wire
Waitlist
← Back to Knowledge Base
OOTW / Chapter I - Foundation / 01. Operating Systems / Windows / 10. Shells

Shells

Users require a way to interact with Windows.

Examples:

  • Launch Programs
  • View Files
  • Configure Services
  • Manage Users
  • Investigate Systems

Windows provides this functionality through shells.

What Is A Shell?

A shell provides an interface between a user and the operating system.

Conceptually:

User
↓
Shell
↓
Operating System

The shell accepts commands from the user and requests actions from Windows.

Example:

User Types Command
        ↓
Shell Interprets Command
        ↓
Windows Performs Action

Graphical Shell

Most users interact with Windows through the graphical shell.

Examples:

Desktop
Taskbar
Start Menu
File Explorer

The primary Windows graphical shell is:

explorer.exe

Conceptually:

User
    ↓
Explorer
    ↓
Windows

Command-Line Shells

Windows also provides command-line shells.

Common examples:

cmd.exe
powershell.exe

These shells allow users to interact with Windows using commands rather than graphical interfaces.

Command Prompt

The traditional Windows command-line shell is:

cmd.exe

Common commands:

dir
whoami
ipconfig
tasklist

Example:

C:\> whoami

pc\alice

Command Prompt remains widely used throughout Windows environments.

PowerShell

PowerShell is the modern Windows command-line shell.

Executable:

powershell.exe

Common commands:

Get-Process
Get-Service
Get-ChildItem
Get-NetTCPConnection

Example:

Get-Process

PowerShell generally provides significantly more functionality than Command Prompt.

Historically, PowerShell has also received substantial attention from defenders because it is widely used by both administrators and attackers.

As a result, many organizations enable extensive logging and monitoring of PowerShell activity.

Command Prompt is generally a simpler shell with fewer capabilities and typically generates less specialized telemetry.

However, both PowerShell and Command Prompt ultimately create processes and generate operating system activity that may be monitored by security products.

The choice between them is therefore usually driven by functionality and operational requirements rather than stealth alone.

Commands

Shells execute commands.

Conceptually:

Command
    ↓
Shell
    ↓
Operating System
    ↓
Result

Example:

Get-Process

Result:

chrome.exe
powershell.exe
explorer.exe

Scripts

Shells can execute multiple commands automatically.

Example:

Get-Process
Get-Service
Get-NetTCPConnection

Saved as:

investigation.ps1

Conceptually:

Script
    ↓
Multiple Commands
    ↓
Automated Execution

Automation is one of the primary reasons shells are powerful.

Command Chaining

Many shells allow commands to be chained together.

Examples:

whoami && hostname && ipconfig  

whoami; hostname; ipconfig

Conceptually:

whoami  
↓  
hostname  
↓  
ipconfig

The shell executes each command in sequence.

PowerShell Pipelines

PowerShell commonly joins operations using pipelines.

Example:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 5

Conceptually:

Get Processes  
↓  
Sort By CPU  
↓  
Select Top 5

Each command passes data to the next command.

Environment Variables

Shells commonly use environment variables.

Examples:

%TEMP%
%PATH%
%USERNAME%

PowerShell:

$env:TEMP
$env:USERNAME

Environment variables provide information about the current environment.

Remote Shells

Shells do not always execute locally.

Example:

Administrator
    ↓
Remote Shell
    ↓
Remote System

Examples include:

  • PowerShell Remoting
  • WinRM
  • SSH

Remote shells are heavily used throughout enterprise environments.

Security Context

Every shell executes within a security context.

Examples:

Alice

Administrator

NT AUTHORITY\SYSTEM

Conceptually:

User
    ↓
Shell
    ↓
Permissions & Privileges

The shell inherits the capabilities of the identity that launched it.

Operator Perspective

When approaching an unfamiliar Windows system, Operators typically ask:

Environment

  • Which shell is available?
  • Is PowerShell available?

Identity

  • Which user am I?
  • Am I elevated?
  • Am I SYSTEM?

Automation

  • Are scripts being used?
  • What scripts exist?

Remote Access

  • Is the shell local?
  • Is the shell remote?

Security

  • What commands were executed?
  • Does shell activity appear unusual?

Many investigations eventually involve shell analysis.

Key Takeaways

  • Shells provide an interface to Windows.
  • Windows includes both graphical and command-line shells.
  • explorer.exe provides the primary graphical shell.
  • cmd.exe provides the traditional command-line shell.
  • PowerShell provides the modern command-line shell.
  • Shells execute commands and scripts.
  • Shells inherit the security context of the user who launched them.
  • Environment variables provide contextual information.
  • Shells can operate locally or remotely.
  • Understanding shells is essential for both offensive and defensive operations.

The Windows curriculum concludes here. The concepts introduced throughout these lessons form the foundation required to understand how the Windows OS works on a surface level.