Get-BluGenieProcessList
Get-BluGenieProcessList
Get a full list of Processes
Get-BluGenieProcessList [[-FilterType] <String>] [[-Pattern] <String>] [[-Managetype] <String>] [[-LazyPathSearch]] [[-Algorithm] <String>] [[-Walkthrough]] [[-Signature]] [[-NotMatch]]
[-ClearGarbageCollecting] [-UseCache] [-CachePath <String>] [-RemoveCache] [-DBName <String>] [-DBPath <String>] [-UpdateDB] [-ForceDBUpdate] [-NewDBTable] [[-ReturnObject]] [[-OutUnEscapedJSON]] [-OutYaml]
[-FormatView <String>] [<CommonParameters>]
Get a full list of Processes and all linked properties including parent processes and process owner information
Command: Get-BluGenieProcessList
Description: Return all the processes on the local machine
Notes: The default Hash Algorithm is (MD5)
Command: Get-BluGenieProcessList -FilterType NoFilter -Algorithm SHA256
Description: Return all the processes on the local machine (default option) with a differnet Hash type
Notes: The Hash Algorithm is (SHA256)
Command: Get-BluGenieProcessList -FilterType NullPaths -Algorithm SHA512
Description: Return all the processes on the local machine that do not have a valid path
Notes: The Hash Algorithm is (SHA512)
Command: Get-BluGenieProcessList -FilterType Name -Pattern shell
Description: Return all the processes on the local machine with a Name field that matches the RegEx pattern
Notes:
Command: Get-BluGenieProcessList -FilterType Name -Pattern '^powershell_ise\.exe$'
Description: This will return all the processes on the local machine with a Name field that matches the RegEx pattern with an Exact Match
Notes:
Command: Get-BluGenieProcessList -FilterType Name -Pattern '^powershell_ise\.exe$' -LazyPathSearch
Description: Return all the processes with an Exact Match and validate path with LazyPathSearch
Notes: By default the process path will be searched for under the entire System drive. This is a (Slow Search).
Command: Get-BluGenieProcessList -FilterType Name -Pattern '^powershell_ise\.exe$' -Managetype Stop
Description: Return all the processes with an Exact Match and Terminate the process
Notes: -Managetype can also [Suspend and Resume]
Command: Get-BluGenieProcessList -Help
Description: Call Help Information
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal
Get-Help will be called with the -Full parameter
Command: Get-BluGenieProcessList -WalkThrough
Description: Call Help Information [2]
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal
Get-Help will be called with the -Full parameter
Command: Get-BluGenieProcessList -OutUnEscapedJSON
Description: The OutUnEscapedJSON is used to beatify the JSON return and not Escape any Characters
Notes:
Command: Get-BluGenieProcessList -ReturnObject
Description: The ReturnObject is used to return a PowerShell Object. Normal return data is a Hash Table.
Notes:
-FilterType <String>
Description: Which property to filter by
Notes:
� Filter Option
o "Caption" Search the Caption Field
o "CommandLine" Search the CommandLine Field
o "Name" Search the Name Field
o "ProcessId" Search the ProcessID Field
o "Path" Search the Path Field
o "ProcessOwner" Search the ProcessOwner Field
o "Process_Hash" Search the Process_Hash Field
o "NoFilter" Return all items with no specific search terms processed
o "NullPaths" Return all items with no valid Path found
o "Signature_Comment" Display error message while pulling Signature Information
[Note: This is only available if you use the -Signature switch]
o "Signature_FileVersion" File Version and OS Build information in part of the OS
[Note: This is only available if you use the -Signature switch]
o "Signature_Description" The description of the files signature [Note: This is only available if you use the -Signature switch]
o "Signature_Date" Date when the file was signed [Note: This is only available if you use the -Signature switch]
o "Signature_Company" The company signing the file [Note: This is only available if you use the -Signature switch]
o "Signature_Publisher" The Publisher signing the file [Note: This is only available if you use the -Signature switch]
o "Signature_Verified" Verification ( Signed / UnSigned / Null ) [Note: This is only available if you use the -Signature switch]
Alias:
ValidateSet: 'Caption','CommandLine','Name','ProcessId','Path','ProcessOwner','Process_Hash','NullPaths','Signature_Comment','Signature_FileVersion','Signature_Description','Signature_Date','Signature_Com
pany','Signature_Publisher','Signature_Verified'
Required? false
Position? 2
Default value Name
Accept pipeline input? false
Accept wildcard characters? false
-Pattern <String>
Description: Search Pattern using RegEx
Notes:
Alias:
ValidateSet:
Required? false
Position? 3
Default value .*
Accept pipeline input? false
Accept wildcard characters? false
-Managetype <String>
Description: Manage the behavior of the process (Suspend, Resume, Stop)
Notes:
Alias:
ValidateSet: 'Suspend','Resume','Stop'
Required? false
Position? 4
Default value
Accept pipeline input? false
Accept wildcard characters? false
-LazyPathSearch [<SwitchParameter>]
Description: Search for processes that do not have a valid path
Notes: The Search is only under any directory in the system environment path variable.
By default the process would be searched for under the System drive.
Alias:
ValidateSet:
Required? false
Position? 5
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-Algorithm <String>
Description: Specifies the cryptographic hash to use for computing the hash value of the contents of the specified file.
Notes: The acceptable values for this parameter are:
- SHA1
- SHA256
- SHA384
- SHA512
- MACTripleDES
- MD5 = (Default)
- RIPEMD160
Alias:
ValidateSet: 'MACTripleDES','MD5','RIPEMD160','SHA1','SHA256','SHA384','SHA512'
Required? false
Position? 6
Default value MD5
Accept pipeline input? false
Accept wildcard characters? false
-Walkthrough [<SwitchParameter>]
Description: Start the dynamic help menu system to help walk through the current command and all of the parameters
Notes:
Alias: Help
ValidateSet:
Required? false
Position? 7
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-Signature [<SwitchParameter>]
Description: Query Signature information
Notes:
Alias:
ValidateSet:
Required? false
Position? 8
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-NotMatch [<SwitchParameter>]
Description: This switch will filter out what items you don't want to query for.
Notes: The search string is assigned to the (Pattern) property.
Alias:
ValidateSet:
Required? false
Position? 9
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-ClearGarbageCollecting [<SwitchParameter>]
Description: Garbage Collection in Powershell to Speed up Scripts and help lower memory consumption
Notes: This is enabled by default. To disable use -ClearGarbageCollecting:$False
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-UseCache [<SwitchParameter>]
Description: Cache found objects to disk. This is to not over tax Memory resources with found artifacts
Notes: By default the Cache location is %SystemDrive%\Windows\Temp
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-CachePath <String>
Description: Path to store the Cache information
Notes: By default the Cache location is %SystemDrive%\Windows\Temp
Alias:
ValidateSet:
Required? false
Position? named
Default value $('{0}\Windows\Temp\{1}.log' -f $env:SystemDrive, $(New-BluGenieUID))
Accept pipeline input? false
Accept wildcard characters? false
-RemoveCache [<SwitchParameter>]
Description: Remove Cache data on completion
Notes: Cache information is removed right before the data is returned to the calling process
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-DBName <String>
Description: Database Name (Without extention)
Notes: The default name is set to 'BluGenie'
Alias:
ValidateSet:
Required? false
Position? named
Default value BluGenie
Accept pipeline input? false
Accept wildcard characters? false
-DBPath <String>
Description: Path to either Save or Update the Database
Notes: The default path is $('{0}\BluGenie' -f $env:ProgramFiles) Example: C:\Program Files\BluGenie
Alias:
ValidateSet:
Required? false
Position? named
Default value $('{0}\BluGenie' -f $env:ProgramFiles)
Accept pipeline input? false
Accept wildcard characters? false
-UpdateDB [<SwitchParameter>]
Description: Save return data to the Sqlite Database
Notes:
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-ForceDBUpdate [<SwitchParameter>]
Description: Force an update of the return data to the Sqlite Database
Notes: By default only new items are saved. The primary key is ( FullName )
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-NewDBTable [<SwitchParameter>]
Description: Delete and Recreate the Database Table
Notes:
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-ReturnObject [<SwitchParameter>]
Description: Return information as an Object
Notes: By default the data is returned as a Hash Table
Alias:
ValidateSet:
Required? false
Position? 10
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-OutUnEscapedJSON [<SwitchParameter>]
Description: Removed UnEsacped Char from the JSON information.
Notes: This will beautify json and clean up the formatting.
Alias:
ValidateSet:
Required? false
Position? 11
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-OutYaml [<SwitchParameter>]
Description: Return detailed information in Yaml Format
Notes: Only supported in Posh 3.0 and above
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-FormatView <String>
Description: Automatically format the Return Object
Notes: Yaml is only supported in Posh 3.0 and above
Alias:
ValidateSet: 'Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml'
Required? false
Position? named
Default value None
Accept pipeline input? false
Accept wildcard characters? false
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
Last modified 1yr ago