Inspect PowerShell command lines
Documentation: Microsoft Learn
A WQL filter restricts Win32_Process to the two PowerShell image names so the selection happens inside the CIM provider rather than in the pipeline.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-CimInstance Win32_Process -Filter "Name='powershell.exe' OR Name='pwsh.exe'" | Select-Object ProcessId,ParentProcessId,CommandLine- Stage 1Get-CimInstance
-Filter - Stage 2Select-Object
Positional values or no named parameters
How it works
A WQL filter restricts Win32_Process to the two PowerShell image names so the selection happens inside the CIM provider rather than in the pipeline. The projection keeps the PID with ParentProcessId, which is what identifies whatever launched it, plus the full CommandLine.
Adapting it
Decode any value passed to -EncodedCommand by converting it from base64 and reading the bytes back as Unicode, since that is where obfuscated payloads are normally carried.
Requirements
Elevation to read command lines belonging to other users' processes.
If the result is unexpected
Process command-line fields are blank or incomplete.
Protected processes and permissions can restrict visibility, and processes can exit during collection.
- Inspect one accessible process and retain process IDs for entries with unavailable command lines.
Validate the result
Unavailable fields are labeled rather than interpreted as commands with no arguments.
Keep the check reliable
Limit exposure of command lines because arguments can contain credentials or other secrets.
