Get-Process
List running processes on Windows.
Windowspassive
Get-Process returns the processes on the local (or remote) machine with CPU/memory and IDs — core triage and IR cmdlet.
Syntax
Get-Process [-Name {pattern}]
Example
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Shows the top 10 processes by CPU usage.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
get-process
Usage examples
Get-Process | Sort CPU -Desc | Select -First 10
Top 10 processes by CPU.
Get-Process -Name powershell
Find PowerShell processes.
Advantages
- Built into Windows
- Rich object output for piping
- Sort/filter/format easily
Disadvantages
- Local by default (remoting for others)
- Limited detail vs Sysinternals
- Needs rights for some processes
Tags
#windows#process#triage
Official docs: Get-Process ↗
Related commands
Frequently asked questions
What is Get-Process used for?
Get-Process returns the processes on the local (or remote) machine with CPU/memory and IDs — core triage and IR cmdlet.
What is an example Get-Process command?
A common example is: Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 — Shows the top 10 processes by CPU usage.
Is Get-Process part of a standard install?
Get-Process runs on Windows. It is typically available by default.
What category of security tool is Get-Process?
Get-Process is a PowerShell tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.