Home › Practice Tools › UnderTheWire - PowerShell Practice Terminal
๐Ÿ’ป
PowerShell

UnderTheWire - PowerShell Practice Terminal

A safe, offline PowerShell-style terminal wargame - find the hidden flag using real PowerShell cmdlets. Save your session as a shareable report.
Ideal for: Windows sysadmins and blue-teamers building real PowerShell cmdlet fluency through a wargame format.

What you'll practice

Start practicing

UnderTheWire - PowerShell Practice Terminal is part of Practice Tools. Sign in or create an account, then subscribe for โ‚ฆ4,000/month to unlock it.

๐Ÿ“‹ Lab Instructions

Step-by-step exercises for UnderTheWire - PowerShell Practice Terminal - read them here, then practice live in the tool above.

Beginner

Last updated: August 22, 2026
Underthewire PowerShell Wargames โ€” Beginner Lab Instructions | CRMNuggets
๐ŸŸข Beginner

Underthewire PowerShell Wargames โ€” Beginner Track

A full walkthrough of how the wargames work, the exact cmdlets and habits you need before you start the clock, and a game-by-game plan for Tutorial, Basilisk, and Phoenix.

No prior PowerShell experience required Windows or PowerShell 7+ (macOS/Linux) Free Underthewire account 20โ€“30 min per game

1. What Underthewire actually is

Underthewire.tech runs timed "wargames" โ€” each one drops you into a live PowerShell session on a target machine and gives you a sequence of numbered questions (usually 15โ€“20). Every question is answered by running a PowerShell command and typing the resulting value into the answer box. Your score depends on how many you get right and how fast you clear the set. Nothing here is multiple choice โ€” you're being tested on whether you can actually operate a shell under time pressure, not whether you can recognize the right answer.

The beginner track exists because jumping straight into a timed game with zero PowerShell background is the single biggest reason people quit after one attempt. This guide gets you to the point where the clock is your only real obstacle.

2. Environment setup

  1. Install PowerShell locally so you can practice outside the timer. Windows ships with Windows PowerShell 5.1 already installed (search "PowerShell" in the Start menu). If you're on macOS or Linux, install PowerShell 7 from Microsoft's official release page โ€” the core cmdlets covered in this guide work the same on both versions.
  2. Create a free account at underthewire.tech and confirm your email โ€” this is required before any game will let you start a timed attempt.
  3. Open the Tutorial game first. It is untimed and exists specifically to show you the UI: where the question panel sits, how the answer box grades your input, and what "partial credit" (if any) looks like for that game.
  4. Keep a second window open with a blank PowerShell console the whole time you're playing โ€” even in the timed games, you're meant to be typing real commands against the target, not guessing.

3. The one skill that matters most: using Get-Help

Almost every beginner question can be solved without memorizing anything, because PowerShell's help system will tell you the exact syntax and give you working examples. Learn this pattern before anything else:

# Update the local help cache once (run as Administrator, needs internet)
Update-Help

# See a short summary of what a cmdlet does
Get-Help Get-Service

# See real, copy-pasteable usage examples โ€” this is the one you'll use constantly
Get-Help Get-Service -Examples

# See every parameter, with full descriptions
Get-Help Get-Service -Full

# See just the syntax block (fastest during a timed game)
Get-Help Get-Service -Detailed
Under time pressure, -Examples is almost always the fastest path to an answer โ€” it shows you real commands rather than abstract parameter descriptions you then have to translate yourself.

Finding a cmdlet when you don't know its name

PowerShell cmdlets follow a strict Verb-Noun naming pattern (Get-Service, Stop-Process, New-Item). If a question asks about something you don't have a cmdlet name for, search by verb or noun instead of guessing:

# Every cmdlet that "gets" something
Get-Command -Verb Get

# Every cmdlet that operates on a "Service"
Get-Command -Noun Service

# Combine both to narrow down fast
Get-Command -Verb Get -Noun Process

# Full list of approved verbs, if you're unsure which one applies
Get-Verb

4. Core cmdlets to know cold before you attempt a timed game

These aren't the only cmdlets you'll see, but they cover the large majority of beginner questions. Practice each one until you can write it without looking it up.

System information

CmdletWhat it's for
Get-ServiceList, filter, start/stop Windows services
Get-ProcessList running processes, CPU/memory usage
Get-ComputerInfoOS version, build number, boot time, hardware summary
Get-EventLog / Get-WinEventRead Windows event logs (older/newer cmdlet respectively)
Get-DateCurrent date/time, and date arithmetic

File system

CmdletWhat it's for
Get-ChildItem (alias ls/dir)List files and folders โ€” supports -Recurse, -Filter, -Hidden
Get-Content (alias cat)Read a file's contents to the console
Get-ItemGet metadata about one specific file or folder
Test-PathCheck whether a file/folder exists (returns True/False)

Practice examples worth running right now

# All services that are currently running
Get-Service | Where-Object Status -eq 'Running'

# Top 5 processes by memory usage
Get-Process | Sort-Object WS -Descending | Select-Object -First 5

# All .log files under C:\Windows, including subfolders
Get-ChildItem -Path C:\Windows -Filter *.log -Recurse -ErrorAction SilentlyContinue

# How many days since the machine last booted
(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
You will see -ErrorAction SilentlyContinue a lot in real usage โ€” it suppresses "access denied" noise when recursing through folders you don't have permission to read. It's optional for beginner games, but good to recognize when you see it in someone else's command.

5. Reading and trusting the output

A common beginner mistake is running the right command but typing the wrong thing into the answer box because the output wasn't read carefully. A few habits fix this:

  • If a question asks for a count, pipe to Measure-Object rather than counting rows by eye: Get-Service | Measure-Object shows a Count property directly.
  • If a question asks for one specific property (a name, an ID, a path), pipe to Select-Object -ExpandProperty <PropertyName> so you get a clean value with no extra formatting to misread.
  • Use Get-Member on any command's output if you're not sure what properties are even available: Get-Process | Get-Member.

6. Game-by-game plan

Tutorial

Untimed ยท Onboarding only

Play this first, no exceptions. It exists purely to teach you the platform: how questions are presented, how answers are graded, what the scoreboard/timer look like, and what to do if you get stuck. Nothing here should feel hard โ€” if it does, stop and go back through section 3โ€“4 of this guide first.

Basilisk

Timed ยท ~15โ€“20 questions

The first real beginner wargame. Expect questions built almost entirely around Get-Help, Get-Command, and basic system/file cmdlets from the tables above. Nothing here should require chaining more than one or two commands together.

Before you attempt it: make sure you can, without looking anything up, list running services, list the top N processes by memory, count items in a folder, and pull help examples for an arbitrary cmdlet.

Phoenix

Timed ยท ~15โ€“20 questions

Similar difficulty to Basilisk but leans slightly more on file-system and event-log questions. Treat it as a second rep of the same muscle rather than a step up โ€” if Basilisk felt shaky, replay it before moving to Phoenix.

7. Pre-attempt checklist

  • I can open help examples for any cmdlet in under 10 seconds
  • I can find a cmdlet by verb/noun without knowing its exact name
  • I'm comfortable with Get-Service, Get-Process, Get-ChildItem, Get-Content, Get-EventLog/Get-WinEvent
  • I know how to isolate a count with Measure-Object and a single property with -ExpandProperty
  • I've completed the untimed Tutorial game

8. What to do after each attempt

Underthewire shows a walkthrough of correct answers once your attempt ends. Don't skip it โ€” for every question you missed, write down which cmdlet or parameter you didn't know, and drill it separately before your next attempt. The goal of the beginner track isn't a perfect score on the first try; it's leaving with zero cmdlets you'd have to look up from scratch next time.

Once you can clear both Basilisk and Phoenix comfortably inside the time limit, move on to the Intermediate track, which shifts the focus from single commands to pipelines.

โ† Back to all practice tools & labs

Intermediate

Last updated: August 22, 2026
Underthewire PowerShell Wargames โ€” Beginner Lab Instructions | CRMNuggets
๐ŸŸข Beginner

Underthewire PowerShell Wargames โ€” Beginner Track

A full walkthrough of how the wargames work, the exact cmdlets and habits you need before you start the clock, and a game-by-game plan for Tutorial, Basilisk, and Phoenix.

No prior PowerShell experience required Windows or PowerShell 7+ (macOS/Linux) Free Underthewire account 20โ€“30 min per game

1. What Underthewire actually is

Underthewire.tech runs timed "wargames" โ€” each one drops you into a live PowerShell session on a target machine and gives you a sequence of numbered questions (usually 15โ€“20). Every question is answered by running a PowerShell command and typing the resulting value into the answer box. Your score depends on how many you get right and how fast you clear the set. Nothing here is multiple choice โ€” you're being tested on whether you can actually operate a shell under time pressure, not whether you can recognize the right answer.

The beginner track exists because jumping straight into a timed game with zero PowerShell background is the single biggest reason people quit after one attempt. This guide gets you to the point where the clock is your only real obstacle.

2. Environment setup

  1. Install PowerShell locally so you can practice outside the timer. Windows ships with Windows PowerShell 5.1 already installed (search "PowerShell" in the Start menu). If you're on macOS or Linux, install PowerShell 7 from Microsoft's official release page โ€” the core cmdlets covered in this guide work the same on both versions.
  2. Create a free account at underthewire.tech and confirm your email โ€” this is required before any game will let you start a timed attempt.
  3. Open the Tutorial game first. It is untimed and exists specifically to show you the UI: where the question panel sits, how the answer box grades your input, and what "partial credit" (if any) looks like for that game.
  4. Keep a second window open with a blank PowerShell console the whole time you're playing โ€” even in the timed games, you're meant to be typing real commands against the target, not guessing.

3. The one skill that matters most: using Get-Help

Almost every beginner question can be solved without memorizing anything, because PowerShell's help system will tell you the exact syntax and give you working examples. Learn this pattern before anything else:

# Update the local help cache once (run as Administrator, needs internet)
Update-Help

# See a short summary of what a cmdlet does
Get-Help Get-Service

# See real, copy-pasteable usage examples โ€” this is the one you'll use constantly
Get-Help Get-Service -Examples

# See every parameter, with full descriptions
Get-Help Get-Service -Full

# See just the syntax block (fastest during a timed game)
Get-Help Get-Service -Detailed
Under time pressure, -Examples is almost always the fastest path to an answer โ€” it shows you real commands rather than abstract parameter descriptions you then have to translate yourself.

Finding a cmdlet when you don't know its name

PowerShell cmdlets follow a strict Verb-Noun naming pattern (Get-Service, Stop-Process, New-Item). If a question asks about something you don't have a cmdlet name for, search by verb or noun instead of guessing:

# Every cmdlet that "gets" something
Get-Command -Verb Get

# Every cmdlet that operates on a "Service"
Get-Command -Noun Service

# Combine both to narrow down fast
Get-Command -Verb Get -Noun Process

# Full list of approved verbs, if you're unsure which one applies
Get-Verb

4. Core cmdlets to know cold before you attempt a timed game

These aren't the only cmdlets you'll see, but they cover the large majority of beginner questions. Practice each one until you can write it without looking it up.

System information

CmdletWhat it's for
Get-ServiceList, filter, start/stop Windows services
Get-ProcessList running processes, CPU/memory usage
Get-ComputerInfoOS version, build number, boot time, hardware summary
Get-EventLog / Get-WinEventRead Windows event logs (older/newer cmdlet respectively)
Get-DateCurrent date/time, and date arithmetic

File system

CmdletWhat it's for
Get-ChildItem (alias ls/dir)List files and folders โ€” supports -Recurse, -Filter, -Hidden
Get-Content (alias cat)Read a file's contents to the console
Get-ItemGet metadata about one specific file or folder
Test-PathCheck whether a file/folder exists (returns True/False)

Practice examples worth running right now

# All services that are currently running
Get-Service | Where-Object Status -eq 'Running'

# Top 5 processes by memory usage
Get-Process | Sort-Object WS -Descending | Select-Object -First 5

# All .log files under C:\Windows, including subfolders
Get-ChildItem -Path C:\Windows -Filter *.log -Recurse -ErrorAction SilentlyContinue

# How many days since the machine last booted
(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
You will see -ErrorAction SilentlyContinue a lot in real usage โ€” it suppresses "access denied" noise when recursing through folders you don't have permission to read. It's optional for beginner games, but good to recognize when you see it in someone else's command.

5. Reading and trusting the output

A common beginner mistake is running the right command but typing the wrong thing into the answer box because the output wasn't read carefully. A few habits fix this:

  • If a question asks for a count, pipe to Measure-Object rather than counting rows by eye: Get-Service | Measure-Object shows a Count property directly.
  • If a question asks for one specific property (a name, an ID, a path), pipe to Select-Object -ExpandProperty <PropertyName> so you get a clean value with no extra formatting to misread.
  • Use Get-Member on any command's output if you're not sure what properties are even available: Get-Process | Get-Member.

6. Game-by-game plan

Tutorial

Untimed ยท Onboarding only

Play this first, no exceptions. It exists purely to teach you the platform: how questions are presented, how answers are graded, what the scoreboard/timer look like, and what to do if you get stuck. Nothing here should feel hard โ€” if it does, stop and go back through section 3โ€“4 of this guide first.

Basilisk

Timed ยท ~15โ€“20 questions

The first real beginner wargame. Expect questions built almost entirely around Get-Help, Get-Command, and basic system/file cmdlets from the tables above. Nothing here should require chaining more than one or two commands together.

Before you attempt it: make sure you can, without looking anything up, list running services, list the top N processes by memory, count items in a folder, and pull help examples for an arbitrary cmdlet.

Phoenix

Timed ยท ~15โ€“20 questions

Similar difficulty to Basilisk but leans slightly more on file-system and event-log questions. Treat it as a second rep of the same muscle rather than a step up โ€” if Basilisk felt shaky, replay it before moving to Phoenix.

7. Pre-attempt checklist

  • I can open help examples for any cmdlet in under 10 seconds
  • I can find a cmdlet by verb/noun without knowing its exact name
  • I'm comfortable with Get-Service, Get-Process, Get-ChildItem, Get-Content, Get-EventLog/Get-WinEvent
  • I know how to isolate a count with Measure-Object and a single property with -ExpandProperty
  • I've completed the untimed Tutorial game

8. What to do after each attempt

Underthewire shows a walkthrough of correct answers once your attempt ends. Don't skip it โ€” for every question you missed, write down which cmdlet or parameter you didn't know, and drill it separately before your next attempt. The goal of the beginner track isn't a perfect score on the first try; it's leaving with zero cmdlets you'd have to look up from scratch next time.

Once you can clear both Basilisk and Phoenix comfortably inside the time limit, move on to the Intermediate track, which shifts the focus from single commands to pipelines.

โ† Back to all practice tools & labs

Expert

Last updated: August 22, 2026
Underthewire PowerShell Wargames โ€” Beginner Lab Instructions | CRMNuggets
๐ŸŸข Beginner

Underthewire PowerShell Wargames โ€” Beginner Track

A full walkthrough of how the wargames work, the exact cmdlets and habits you need before you start the clock, and a game-by-game plan for Tutorial, Basilisk, and Phoenix.

No prior PowerShell experience required Windows or PowerShell 7+ (macOS/Linux) Free Underthewire account 20โ€“30 min per game

1. What Underthewire actually is

Underthewire.tech runs timed "wargames" โ€” each one drops you into a live PowerShell session on a target machine and gives you a sequence of numbered questions (usually 15โ€“20). Every question is answered by running a PowerShell command and typing the resulting value into the answer box. Your score depends on how many you get right and how fast you clear the set. Nothing here is multiple choice โ€” you're being tested on whether you can actually operate a shell under time pressure, not whether you can recognize the right answer.

The beginner track exists because jumping straight into a timed game with zero PowerShell background is the single biggest reason people quit after one attempt. This guide gets you to the point where the clock is your only real obstacle.

2. Environment setup

  1. Install PowerShell locally so you can practice outside the timer. Windows ships with Windows PowerShell 5.1 already installed (search "PowerShell" in the Start menu). If you're on macOS or Linux, install PowerShell 7 from Microsoft's official release page โ€” the core cmdlets covered in this guide work the same on both versions.
  2. Create a free account at underthewire.tech and confirm your email โ€” this is required before any game will let you start a timed attempt.
  3. Open the Tutorial game first. It is untimed and exists specifically to show you the UI: where the question panel sits, how the answer box grades your input, and what "partial credit" (if any) looks like for that game.
  4. Keep a second window open with a blank PowerShell console the whole time you're playing โ€” even in the timed games, you're meant to be typing real commands against the target, not guessing.

3. The one skill that matters most: using Get-Help

Almost every beginner question can be solved without memorizing anything, because PowerShell's help system will tell you the exact syntax and give you working examples. Learn this pattern before anything else:

# Update the local help cache once (run as Administrator, needs internet)
Update-Help

# See a short summary of what a cmdlet does
Get-Help Get-Service

# See real, copy-pasteable usage examples โ€” this is the one you'll use constantly
Get-Help Get-Service -Examples

# See every parameter, with full descriptions
Get-Help Get-Service -Full

# See just the syntax block (fastest during a timed game)
Get-Help Get-Service -Detailed
Under time pressure, -Examples is almost always the fastest path to an answer โ€” it shows you real commands rather than abstract parameter descriptions you then have to translate yourself.

Finding a cmdlet when you don't know its name

PowerShell cmdlets follow a strict Verb-Noun naming pattern (Get-Service, Stop-Process, New-Item). If a question asks about something you don't have a cmdlet name for, search by verb or noun instead of guessing:

# Every cmdlet that "gets" something
Get-Command -Verb Get

# Every cmdlet that operates on a "Service"
Get-Command -Noun Service

# Combine both to narrow down fast
Get-Command -Verb Get -Noun Process

# Full list of approved verbs, if you're unsure which one applies
Get-Verb

4. Core cmdlets to know cold before you attempt a timed game

These aren't the only cmdlets you'll see, but they cover the large majority of beginner questions. Practice each one until you can write it without looking it up.

System information

CmdletWhat it's for
Get-ServiceList, filter, start/stop Windows services
Get-ProcessList running processes, CPU/memory usage
Get-ComputerInfoOS version, build number, boot time, hardware summary
Get-EventLog / Get-WinEventRead Windows event logs (older/newer cmdlet respectively)
Get-DateCurrent date/time, and date arithmetic

File system

CmdletWhat it's for
Get-ChildItem (alias ls/dir)List files and folders โ€” supports -Recurse, -Filter, -Hidden
Get-Content (alias cat)Read a file's contents to the console
Get-ItemGet metadata about one specific file or folder
Test-PathCheck whether a file/folder exists (returns True/False)

Practice examples worth running right now

# All services that are currently running
Get-Service | Where-Object Status -eq 'Running'

# Top 5 processes by memory usage
Get-Process | Sort-Object WS -Descending | Select-Object -First 5

# All .log files under C:\Windows, including subfolders
Get-ChildItem -Path C:\Windows -Filter *.log -Recurse -ErrorAction SilentlyContinue

# How many days since the machine last booted
(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
You will see -ErrorAction SilentlyContinue a lot in real usage โ€” it suppresses "access denied" noise when recursing through folders you don't have permission to read. It's optional for beginner games, but good to recognize when you see it in someone else's command.

5. Reading and trusting the output

A common beginner mistake is running the right command but typing the wrong thing into the answer box because the output wasn't read carefully. A few habits fix this:

  • If a question asks for a count, pipe to Measure-Object rather than counting rows by eye: Get-Service | Measure-Object shows a Count property directly.
  • If a question asks for one specific property (a name, an ID, a path), pipe to Select-Object -ExpandProperty <PropertyName> so you get a clean value with no extra formatting to misread.
  • Use Get-Member on any command's output if you're not sure what properties are even available: Get-Process | Get-Member.

6. Game-by-game plan

Tutorial

Untimed ยท Onboarding only

Play this first, no exceptions. It exists purely to teach you the platform: how questions are presented, how answers are graded, what the scoreboard/timer look like, and what to do if you get stuck. Nothing here should feel hard โ€” if it does, stop and go back through section 3โ€“4 of this guide first.

Basilisk

Timed ยท ~15โ€“20 questions

The first real beginner wargame. Expect questions built almost entirely around Get-Help, Get-Command, and basic system/file cmdlets from the tables above. Nothing here should require chaining more than one or two commands together.

Before you attempt it: make sure you can, without looking anything up, list running services, list the top N processes by memory, count items in a folder, and pull help examples for an arbitrary cmdlet.

Phoenix

Timed ยท ~15โ€“20 questions

Similar difficulty to Basilisk but leans slightly more on file-system and event-log questions. Treat it as a second rep of the same muscle rather than a step up โ€” if Basilisk felt shaky, replay it before moving to Phoenix.

7. Pre-attempt checklist

  • I can open help examples for any cmdlet in under 10 seconds
  • I can find a cmdlet by verb/noun without knowing its exact name
  • I'm comfortable with Get-Service, Get-Process, Get-ChildItem, Get-Content, Get-EventLog/Get-WinEvent
  • I know how to isolate a count with Measure-Object and a single property with -ExpandProperty
  • I've completed the untimed Tutorial game

8. What to do after each attempt

Underthewire shows a walkthrough of correct answers once your attempt ends. Don't skip it โ€” for every question you missed, write down which cmdlet or parameter you didn't know, and drill it separately before your next attempt. The goal of the beginner track isn't a perfect score on the first try; it's leaving with zero cmdlets you'd have to look up from scratch next time.

Once you can clear both Basilisk and Phoenix comfortably inside the time limit, move on to the Intermediate track, which shifts the focus from single commands to pipelines.

โ† Back to all practice tools & labs