Processes / Services

View running processes and services:

C:\> tasklist /svc

List all running Services

PS C:\> Get-Service | ? {$_.Status -eq "Running"} | select -First 2 | fl

Examine Service permissions

PS C:\> Get-ACL -Path HKLM:\System\CurrentControlSet\Services\wuauserv | Format-List

View service by PID

C:\> tasklist /FI "PID eq 1337"
PS C:\> Get-WmiObject Win32_Process -Filter "ProcessId = 1337" | Select-Object Name, ProcessId, CommandLine
PS C:\> get-process -Id 1337

Get service by name

PS C:\> get-service | ? {$_.DisplayName -like 'AMOGUS*'}

Get all service paths

PS C:\> wmic service get name, pathname
PreviousGroupsNextPermissions