Process Hacker

processhacker.exe # → Hidden Processes

Inspect system processes with Process Hacker, revealing hidden processes and details that Task Manager does not show.

Run it when you need the real view of a host's processes: Process Hacker shows processes with their handles, DLLs, threads, network, and tokens — and its hidden process check (those not appearing in normal lists due to rootkit techniques) is one of its distinguishing features. In live IR, Process Hacker is the inspection tool: the suspicious process is examined (what DLLs it loaded, what handles it has, who it talks to over the network) without killing it. The per-process network view and tokens complete the picture of the compromise at that moment.

Do not use it as definitive detection: Process Hacker's hidden process view depends on techniques — advanced rootkits hide processes at the kernel level and detection requires memory analysis (Volatility) or kernel debugging. On hosts with PPL or protected processes, inspection of certain processes fails. And beware: Process Hacker is a well-known tool and some EDRs flag it — and it is the same tool attackers use to inspect (and kill) AV processes; its presence on a production host is justified by IR. For persistent monitoring, Sysmon and the EDR are the layer; Process Hacker is the point-in-time inspection.