Query for all Processes not running from the Windows and Program Files.* Directories
#####aid_begin
#description: process query for all processes that are not running from %systemdrive%\windows,%systemdrive%\program files*
#id: aid2201212352
#processtype: query
#category: process
#sourcelink: <na>
#tacticidlist: <na>
#techniqueidlist: <na>
#compatibleos: |-
# windows 7
# windows 8.*
# windows 10
# windows 11
# windows server 2008 r2
# windows server 2012
# windows server 2012 r2
# windows server 2016
# windows server 2019
#compatibleengine: |-
# powershell 2
# powershell 3
# powershell 4
# powershell 5.*
# powershell 7.*
#bgcommandlist: |-
# get-bgprocesslist
#notes: |-
# process query for all processes that are not running from %systemdrive%\windows,%systemdrive%\program files*
#####aid_end
commands:
- Get-BGProcessList -FilterType Path -Pattern $("^(?!{0}\\Windows|{0}\\Program Files).*$" -f $Env:SystemDrive)
Last updated