TryHackMe-Windows PowerShell

skipped 1- 4 leval

Level 5: Filtering and Sorting Data

1. Key Concept: What is Piping?

• Imagine a water pipe . Water goes in one side and comes out the other side into a bucket. In computer commands, Piping connects two commands. The output (result) of Command 1 goes directly as input into Command 2.
• The Symbol: The vertical line | (called the Pipe symbol).

2.Basic Vocabulary & Cmdlets

• Cmdlet (Command-let): A small built-in command in Windows PowerShell.
• Property: Information attached to a file, like its Name, Length (size), or Extension (.txt, .png).
• Get-ChildItem: Lists all files and folders in the current directory (folder).
• Sort-Object: Re-orders your data (for example, small to big size).
• Where-Object: Filters your data so you only see what meets a specific rule.
• Select-Object: Picks only specific details (like showing only file names, not dates). 🎯

3.Comparison Operators (The Rules for Filtering) ⚖️

When using Where-Object, we need operators to compare values:

• -eq (Equal to): Looks for an exact match.
• -ne (Not Equal to): Excludes an item.
• -gt (Greater than): Pick items larger than a number. (Strict: equal numbers are NOT included)
• -ge (Greater than or Equal to): Pick items larger than or equal to a number.
• -lt (Less than): Pick items smaller than a number.
• -le (Less than or Equal to): Pick items smaller than or equal to a number.

4. why Piping matters in cybersecurity

In cybersecurity, long files and systems directories contain thousands of entries. you cannot read them manually!

Get siva’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

By combining piping with filtering commands (Where-Object or Select-String) you can quickly search for suspicious files, malware, or attacker activity in seconds.

5. solve the Question

How would you retrieve the items in the current directory with size greater than 100? [for the sake of this question, avoid the use of quotes (“ or ‘) in your answer]

Let’s build this command step by step

Step 1 : Get the list of items in the directory

Command- Get-ChildItem

step 2 : Add a pipe symbol | to send item to filter command

Add: - | Where-Object

step 3 : Tell it to check the file size property without quotes.

Add: -Property Length

step 4: Use the correct operator for greater then followed the number 10 -gt

Ans : Get-ChildItem | Where-Object -Property Length -gt 100