Skip to content

Instantly share code, notes, and snippets.

@tyranid
Created August 27, 2020 14:54
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 3 You must be signed in to fork a gist
  • Save tyranid/ea89038089f8c5f7c614bdcee07c78cb to your computer and use it in GitHub Desktop.
Save tyranid/ea89038089f8c5f7c614bdcee07c78cb to your computer and use it in GitHub Desktop.
# Sneaky process listing.
function Get-FilePids {
[Parameter(Mandatory, Position = 0)]
Param($Path)
try {
Use-NtObject($file = Get-NtFile -Win32Path $Path -Access ReadAttributes) {
$file.GetUsingProcessIds() | Write-Output
}
} catch {
Write-Error $_
}
}
$exes = ls $env:windir -Recurse -Filter *.exe -ErrorAction Ignore
foreach($exe in $exes) {
$pids = Get-FilePids -Path $exe.FullName
foreach($p in $pids) {
$props = @{
Path = $exe.FullName;
Name = $exe.Name;
ProcessId = $p;
}
New-Object -TypeName PSObject -Property $props | Write-Output
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment