psgrep windows

Get-Process | Where CommandLine -match '<pattern>'

Search for processes by their command line with PowerShell, the Windows process grep to hunt for running attack tools.

Run it when you want to know if a specific tool or pattern is running on the host: the filter on CommandLine (using Get-CimInstance Win32_Process to get the cmdline, which Get-Process does not expose by default) searches for any substring — tool names (mimikatz, procdump), download URLs, suspicious arguments (PowerShell -enc, -w hidden). It's the everyday process grep for hunting: fast, no installation needed, and the same logic works for hunting download cradles, miners, or Temp binaries in execution. In the SOC, it's the first check on a process alert.

Don't use it on hosts without access to the cmdline: Win32_Process CommandLine requires permissions; without admin, some processes from other users don't show their line. And note: it's a snapshot — a process that already ended won't appear; for temporal detection, use Sysmon Event 1 or the EDR. Substring filtering generates false positives with common words (e.g., 'update' in any update process): refine the pattern or combine multiple fields. On hosts with many processes, the query without prior filtering (by name or path) scans everything — filter by the fields that matter.