#audit

One forgotten command shows all sockets on the Mac with the owning process, unlike netstat's bare connection table.

The forgotten Get-HotFix cmdlet answers 'is KBxxxxxxx installed?' in one line, locally or on remote machines.

Enumerate every binary that runs with elevated privileges — unexpected entries here are the classic local privilege-escalation vector.

Enumerate local Administrators, Remote Desktop Users or any local group membership with Get-LocalGroupMember, including domain-sourced accounts.

Before pasting a sudo command from a tutorial, or when writing automation, `sudo -l` shows precisely what your account is allowed to run — and what will be rejected.

Get-MpThreatDetection reveals the full detection history the Windows Security app doesn't show.

List every file that any user on the system could modify.

Query the kernel audit log with ausearch for security-relevant events — logins, file access, or specific commands — in readable form.

A quick audit that catches passwordless accounts — a silent backdoor on any Linux box.

See the signing identity, TeamID, CDHash, and entitlements of any application on your Mac.

Print one line per system account showing when it last logged in — or 'Never logged in' for accounts nobody has used.

The forgotten counterpart of `last`: lastb reads /var/log/btmp and shows every failed login — the quickest way to see whether your SSH server is being brute-forced.