Gathering Forensic Process Info

In order to better understand the processes that run on a server, and possibly identify traces of unwanted processes, PowerShell can dump forensic process information to CSV file in a way that Excel (if installed) can open the file. This way it is easy to review the processes and their command lines and start parameters.

Here is the code:

$Path = "$env:temp\processList.csv"

# get all processes...
Get-CimInstance -ClassName Win32_Process | 
    # select forensic properties...
    Select-Object -Property Name, HandleCount, ProcessId, ParentProcessId, Path, CommandLine  | 
    # write to a CSV file
    Export-Csv -Path $Path -Encoding UTF8 -UseCulture -NoTypeInformation

# load CSV into Excel (needs to be installed of course)
Start-Process -FilePath excel -ArgumentList $Path

Note that you won’t get some process details for processes launched by someone else unless you run this with Administrator privileges.

ReTweet this Tip!