wmic

Windows Management Instrumentation Command-line (WMIC) is a (now deprecated) command-line method of working with WMI.
- The new/supported method is using PowerShell, and commands can be found with Get-Command -Noun *WMI* and Get-Command -Noun *CIM*

wmic process list full
1. List all processes
wmic process get name,parentprocessid,processid
1. Shows the ID and process ID of each process running
wmic process where processid=[PID] get commandline
1. See what commands were used to launch the process
  1. Processes started through mouse/keyboard interaction list the full path of the executable
  2. Processes started through command line tend to only show the name of the executable and any switches used, but it's anything the person enters into the CLI
  3. Check the end of the BHIS-SOCC-lab-WindowsCLI for details

Metadata