CmdID

CmdID / Commands

qprocess

Displays information about processes that are running on a Remote Desktop Session Host server. Windows commands reference

On Windows 1 Sigma rule name it File qprocess.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Displays information about processes that are running on a Remote Desktop Session Host server. To find out what's new in the latest version, see What's New in Remote Desktop Services in Windows Server. NOTE: This command is the same as the query process command.

What detects it

Sigma process creation rules that name qprocess
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)