So let's go into our machine,
and we'll first look at how we retrieve running processes
from a local and a remote computer,
and then we'll also look at how we can retrieve running
services from a local and remote computer.
So we're back on the Windows device, and we're just using PowerShell.
Now to retrieve things like processes that are running on a machine,
PowerShell provides a command called Get‑Process.
Get‑Process, for example, if I just right‑click here and do Task Manager,
it's very similar to the way Task Manager lists all of its processes.
But, of course, it's done in the PowerShell context.
Now what's interesting here is, let me just launch Calculator,
so what I can then do is do Get‑Process.
And if we just scroll through the list of processes,
there's a whole bunch of them in here,
you'll see that Calculator is listed as a ProcessName.
Now from a PowerShell perspective, let me just clear this down,
if I wanted to look at this specific process,
I also have the ability to say Process ‑Name,
and I can say CalculatorApp, like so, and press Enter.
Now notice what happens, it's not CalculatorApp,
it's going to be Calculator, which is the exact name of the process.
So when we're trying to retrieve process information,
we need to make sure that we get the exact name that's there as well.
Now we can also go one step further.
We can also look for multiple processes if we're trying to get the information.
So I can say get a formatted list, and then,
of course, it complains now about Notepad,
and that's because we can't retrieve both those processes.
So if I launch Notepad and then go back to the same thing,
notice it'll complain again because what I've done
here is we've put it in quotes, which means it's looking for the text values.
So we're going to take those out,
and it's now going to look for Calculator and Notepad.
And if we just scroll a bit further up here,
you'll see that we'll get the first one,
which is Notepad, and then we scroll all the way back up at the top,
and you'll see Calculator is listed there as well.
So let me just clear that, and we'll do the same thing we've got here.
Now, of course, we can also get process information about that actual process,
so let's just go back and say Get‑Process Calculator.
What we can do, one is to utilize parentheses here,
so Get‑Process ‑Name, like so,
and then we actually have access to other properties that are available.
And I'm just Tabbing, and you can see if I do Path,
it gives me the path to the executable.
If I wanted to change that, you can see I've got all these different options,
so Company, obviously made by Microsoft.
If I get rid of that,
I can literally loop through all of the properties or
attributes associated to a process,
so it's a nice way of being able to understand a bit
more about a specific process.
Now, we can also just simply just get the process like we were before.
So we can say ‑Name, I'm going to say Calculator,
like so, and then I can say I would like to Include the UserName.
And now, of course, you notice I can't spell calculator right,
Calculator, there we go,
and now it shows me the UserName that that process is running under,
which is quite helpful.
Now we can also go one step further,
and we can get information about the file version itself,
and you can see we've got the ProductVersion and the
FileVersion and then the location to it as well.
Now, if we didn't know any of the information we were looking for,
really from a process perspective, we could just run Get‑Process,
maybe we want to include the UserNames,
and then we can use regular PowerShell to actually perform a Where clause.
So let's say we were looking for ones that are using the system account,
for example, so I could say ‑like *System*,
like so.
And then this will list me all of the processes that are running a system,
and you can see one of the ones we used earlier was the sshd or the SSH service,
and that runs a system, and you can see a whole host of other ones too.
So even if we don't know the exact process,
we can obviously go through and just check.
Now we also can retrieve CPU information and things like that too.
Now what does that look like?
Let me just loop through here.
So if we go back to this option, you'll notice that as we were looping through,
I had a CPU option, which gives me a random 0.484,
which doesn't really make any sense.
So we can combine all of this with regular PowerShell to be able to
get the values that we're actually looking for.
So you can see I'm doing some math calculation here,
and I'm saying what I'd like to do is take the CPU value that we get,
and then I'd like to round it, and this would give me a value of 0.48,
which is going to be the amount of processing power that's being used.
We could also change that, and I could say VM,
and then adjust this one a little bit, and we're going to do that,
and you'll see that we've got the Round,
and I missed a character here, let me go back and do that.
There we go.
And it tells me how much virtual memory is being utilized.
So it's important to know that we can combine regular
PowerShell commands with process retrieval.
If we wanted to perform those same types of commands, but remotely,
we first need some kind of session.
So we're going to initiate a remote session,
so I'm going to say New‑PSSession 192.168.127.128,
press Enter.
And, of course, it's obviously going to give me an access denied,
so I need to pass some kind of connectivity to it.
And you'll notice that I don't have anything apart from a
Credential object because when we did the first one,
I wasn't passing anything, and so if my cred's object is valid,
then, of course, it's now going to create me the session.
So remember,
Credential objects can be reused as long as we don't close the session down.
So now that I have that connected, I'm going to Enter the PSSession,
and I'm going to say session.
This now puts me onto that machine, so I can now say Get‑Process,
and this will list all of the processes that are running on that other machine.
But, of course, I don't have a calculator,
but I do have a cmd command, which means I have a console running.
So what I can do now is utilizing that Get‑Process option,
I can then say ‑Name, cmd,
and it will get me the specific process information around that,
and nothing else.
We can also then use the same options as before,
where we can look for the properties.
So, you know, I can say .Path, and it will show you where the things are.
I could also do the file version option as well,
so I can say, let's go back to the Get‑Process one,
and I can say FileVersionInfo, and it will give me that information too.
And, of course, with the CPU and the virtual memory,
I can do the exact same thing as well.
So this is a very clean way of being able to run and
execute those commands on a remote machine,
just as simple as creating a new session and then utilizing it that way.