See the Full Command Line Behind a Process (Win32_Process)
Use Get-CimInstance Win32_Process to reveal the exact command line that started each process — great for spotting look-alikes.
01Command
$ Get-CimInstance Win32_Process | Select-Object ProcessId, Name, CommandLine02What it does
Task Manager only shows a process name, but malware and suspicious scripts often hide in the arguments. Win32_Process exposes the CommandLine property with the complete launch string, so you can tell genuine svchost.exe activity from a fake file named similarly in an odd folder. Filter with Where-Object on Name or PID to inspect a single process.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- Win32_Process classEvidence: Class definition lists the CommandLine string property ('the command line used to start a specific process') alongside ProcessId and Name.
- Get-CIMInstance — Get WMI/CIM class instancesEvidence: Syntax shows Get-CimInstance -ClassName <String> usage for querying CIM/WMI classes such as Win32_Process, piped to Select-Object for chosen properties.
Last verified: 2026-09-19 · Category: System & Settings
06Related solutions
Register a recurring Windows task entirely from the command line — ideal for scripts, cleanup jobs, and monitoring probes you want to run unattended.
Use the System File Checker to verify every protected Windows system file against known-good copies and automatically replace the damaged ones.
Use Windows Package Manager to install, search, and upgrade thousands of applications from the community repository in one command.