> For the complete documentation index, see [llms.txt](https://manuals.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://manuals.blusapphire.io/blugenie/artifacts/tactical-artifacts-by-category/process-query/query-for-all-processes-not-running-from-the-windows-and-program-files.-directories.md).

# Query for all Processes not running from the Windows and Program Files.\* Directories

```
#####aid_begin
#description: process query for all processes that are not running from %systemdrive%\windows,%systemdrive%\program files*
#id: aid2201212352
#processtype: query
#category: process
#sourcelink: <na>
#tacticidlist: <na>
#techniqueidlist: <na>
#compatibleos: |-
#  windows 7
#  windows 8.*
#  windows 10
#  windows 11
#  windows server 2008 r2
#  windows server 2012
#  windows server 2012 r2
#  windows server 2016
#  windows server 2019
#compatibleengine: |-
#  powershell 2
#  powershell 3
#  powershell 4
#  powershell 5.*
#  powershell 7.*
#bgcommandlist: |-
#  get-bgprocesslist
#notes: |-
#  process query for all processes that are not running from %systemdrive%\windows,%systemdrive%\program files*
#####aid_end
commands:
- Get-BGProcessList -FilterType Path -Pattern $("^(?!{0}\\Windows|{0}\\Program Files).*$" -f $Env:SystemDrive)
```