Find processes outside Windows directories
Documentation: Microsoft Learn
Query Win32_Process with Get-CimInstance to inspect executable paths outside C:\Windows, alongside process names and IDs.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -and $_.ExecutablePath -notlike 'C:\Windows\*' } | Select-Object Name,ProcessId,ExecutablePath- Stage 1Get-CimInstance
Positional values or no named parameters - Stage 2Where-Object
Positional values or no named parameters - Stage 3Select-Object
Positional values or no named parameters
How it works
Win32_Process is queried through Get-CimInstance, and the intent is to keep processes whose ExecutablePath is populated and does not sit under C:\Windows, reporting the image name, PID, and full path for each survivor.
Adapting it
Add a hash column by piping each ExecutablePath through Get-FileHash so the survivors can be checked against a reputation service in bulk rather than one filename at a time.
Requirements
Elevation, or ExecutablePath comes back blank for processes owned by other accounts.
If the result is unexpected
The process report misses executables or includes legitimate software outside Windows folders.
ExecutablePath can be unavailable for protected processes, and location outside Windows is not evidence of malware.
- Inspect one missing process with the intended privileges and review its path, publisher and purpose.
Validate the result
Null paths are distinguished from excluded paths, and flagged processes have been individually reviewed.
Keep the check reliable
Keep exclusions explicit and label this report as an investigation starting point.
