tasklist & Get-Process — Process Enumeration
Built-in Windows commands to list running processes and PIDs. Essential before LSASS dumps, killing stuck processes, and spotting security tools.
OSCP use:
tasklist | findstr lsass→ PID for comsvcs / procdump dump ·Get-Processfor PowerShell-only shells · pair with netstat for listeners + PIDs.
📌 tasklist (CMD)
tasklist
tasklist /v REM Verbose — user, window title, memory
tasklist /svc REM Services hosted in each process
tasklist /fi "imagename eq lsass.exe"
tasklist /fi "username eq SYSTEM"
tasklist /m REM Loaded DLL modulesFind specific process PID
tasklist | findstr lsass
tasklist | findstr exe
tasklist | findstr sql
tasklist | findstr defenderMatch PID from netstat
netstat -ano | findstr LISTENING
tasklist /fi "pid eq 1234"→ netstat
📌 Get-Process (PowerShell)
Get-Process
Get-Process lsass
Get-Process -Name lsass
Get-Process -Id 672
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Get-Process | Where-Object {$_.ProcessName -like "*sql*"}
Get-Process | Where-Object {$_.Company -like "*Microsoft*"}LSASS PID (for dump commands)
(Get-Process lsass).Id
Get-Process lsass | Select-Object Id, ProcessName, Path, StartTime
[System.Diagnostics.Process]::GetProcessesByName("lsass")[0].IdKill / start (privesc cleanup)
Stop-Process -Name notepad -Force
Start-Process -FilePath C:\Temp\winPEAS.exe -Wait -NoNewWindow→ Full cmdlet hub: PowerShell Cmdlets
📌 Common OSCP pairings
| Goal | Command |
|---|---|
| LSASS dump via comsvcs | tasklist | findstr lsass → rundll32 ... MiniDump <PID> ... |
| Who owns port 445 listener | netstat -ano | findstr :445 → tasklist /fi "pid eq PID" |
| Find AV/EDR | tasklist | findstr -i defender symantec mcafee |
| Service account processes | tasklist /v | findstr SERVICE |
→ LSASS · Windows PrivEsc
📌 Quick Cheat Sheet
tasklist
tasklist | findstr lsass
tasklist /fi "pid eq 1234"
netstat -ano | findstr LISTENINGGet-Process lsass
(Get-Process lsass).Id
Get-Process | Sort CPU -Desc | Select -First 10