CmdID / PowerShell / Cmdlets / Get
Get-Process
Gets the processes that are running on the local computer or a remote computer. PowerShell reference
From the PowerShell reference
7 parameters
Aliases gps, ps
1 Sigma rule looks for it
What it does
Gets the processes that are running on the local computer or a remote computer. The Get-Process cmdlet gets the processes on a local or remote computer. Without parameters, this cmdlet gets all processes on the local computer. You can also specify a specific process by process name or process ID (PID), or by piping a System.Diagnostics.Process object to this cmdlet. By default, this cmdlet returns a Process object that has detailed information about the process and supports methods that let you control it. With parameters, you can change the type of information returned by this cmdlet. - Module: Retrieve information for each module loaded into the process. - FileVersionInfo: Retrieve file version information for the main module of the process. NOTE: A module is an executable file or a dynamic link library (DLL) loaded into a process. A process has one or more modules. The main module is the module used to initially start the process. For more information, see ProcessModule Class.
Get-Process [[-Name] <String[]>] [-ComputerName <String[]>] [-Module] [-FileVersionInfo] [<CommonParameters>]Get-Process [[-Name] <String[]>] [-IncludeUserName] [<CommonParameters>]Get-Process -Id <Int32[]> [-IncludeUserName] [<CommonParameters>]Get-Process -Id <Int32[]> [-ComputerName <String[]>] [-Module] [-FileVersionInfo] [<CommonParameters>]Get-Process -InputObject <Process[]> [-IncludeUserName] [<CommonParameters>]Get-Process -InputObject <Process[]> [-ComputerName <String[]>] [-Module] [-FileVersionInfo] [<CommonParameters>]Get a list of all running processes on the local computer
Get-ProcessIdentifyDisplay detailed information about one or more processes
Get-Process winword, explorer | Format-List *IdentifyGet all processes with a working set greater than a specified size
Get-Process | Where-Object { $_.WorkingSet -gt 20971520 }
Get-Process | Where-Object WorkingSet -GT 20MBIdentifyDisplay processes on the computer in groups based on priority
$processes = Get-Process
$processes | Sort-Object { $_.PriorityClass } | Format-Table -View PriorityIdentifyAdd a property to the default Get-Process output display
Get-Process -Name powershell | Format-Table -Property @(
'Handles'
@{ Name = 'NPM(K)'; Expression = { [int] ($_.NPM / 1KB) } }
@{ Name = 'PM(K)'; Expression = { [int] ($_.PM / 1KB) } }
@{ Name = 'WS(K)'; Expression = { [int] ($_.WS / 1KB) } }
@{ Name = 'CPU(s)'; Expression = { if ($_.CPU) { $_.CPU.ToString('N') } } }
'Id'
@{ Name = 'SI'; Expression = 'SessionId' }
'ProcessName'
'StartTime'
) -AutoSizeIdentifyGet version information for a process
Get-Process -Name powershell -FileVersionInfoIdentifyGet modules loaded with the specified process
Get-Process -Name SQL* -ModuleIdentifyFind the owner of a process
Get-Process -Name powershell -IncludeUserNameIdentifyUse an automatic variable to identify the process hosting the current session
Get-Process -Name powershellIdentifyGet all processes that have a main window title and display them in a table
Get-Process |
Where-Object -Property MainWindowTitle |
Format-Table -Property Id, Name, MainWindowTitle -AutoSizeIdentifyIts page in the reference: Get-Process.
Parameters
-ComputerNameSpecifies the computers for which this cmdlet gets running processes. The default is the local computer.
Specify the NetBIOS name, an IP address, or a fully qualified domain name (FQDN) of one or more computers. To specify the local computer, use the computer name, a dot (.), or localhost.
This parameter doesn't rely on Windows PowerShell remoting. You can use the ComputerName parameter of this cmdlet even if your computer isn't configured to run remote commands.-FileVersionInfoIndicates that this cmdlet gets the file version information for the program that runs in the process.
On Windows Vista and later versions of Windows, you must run PowerShell with elevated user rights (Run as administrator) to use this parameter on processes that you don't own.
You can't use the FileVersionInfo and ComputerName parameters together.
To get file version information for a process on a remote computer, use the Invoke-Command cmdlet.
Using this parameter is the same as accessing the MainModule.FileVersionInfo property of each Process object. When you use this parameter, Get-Process returns a FileVersionInfo object, not a Process object. You can't pipe output produced using this parameter to a cmdlet that expects a Process object, such as Stop-Process.-IdSpecifies one or more processes by process ID (PID). You can specify multiple IDs separated by commas. To get the PID of a process, use Get-Process. To get the PID of the current PowerShell session, use $PID.-IncludeUserNameIndicates that this command adds a UserName property to each returned Process object.
You must run PowerShell with elevated user rights (Run as administrator) to use this parameter.-InputObjectSpecifies one or more Process objects. Use a variable that contains the objects, or a command or expression that gets the objects.-ModuleIndicates that this cmdlet gets the modules that the process has loaded.
On Windows Vista and later versions of Windows, you must run PowerShell with elevated user rights (Run as administrator) to use this parameter on processes that you don't own.
To get the modules loaded by a process on a remote computer, use the Invoke-Command cmdlet.
Using this parameter is the same as accessing the Modules property of each Process object. When you use this parameter, Get-Process returns a ProcessModule object, not a Process object. You can't pipe output produced using this parameter to a cmdlet that expects a Process object, such as Stop-Process.
When you use both the Module and FileVersionInfo parameters together, this cmdlet returns a FileVersionInfo object with information about the file version of all modules.-NameSpecifies one or more processes by process name. You can specify multiple process names separated by commas and use wildcard characters. Using the -Name parameter is optional.