Hacker tools

Windows Investigation with PowerShell

Open an Administrator PowerShell session

Process Enumeration

First, we’ll look at the processes running on Windows. While the GUI Task Manager tool can be useful, we’ll focus on the corresponding PowerShell commands for the most flexibility and available detail.

Get-Process

In this output we see several columns of information:

  • Handles: A count of handles (open files, sockets, and pipe resources)
  • NPM(K): The amount of non-paged memory the process is using in kilobytes
  • PM(K): The amount of paged memory the process is using in kilobytes
  • WS(K): The process working set size (the total amount of memory allocated to a process) in kilobytes
  • CPU(s): The amount of processor time that the process has used on all processors, in seconds
  • Id: The unique identifier for a process so that the system can reference it by the numeric value, also known as a Process ID or PID
  • SI: The session ID for the user session that owns the process
  • ProcessName: The process name, often the executable name