volatility3 cmdline

vol.py -f mem.dmp windows.cmdline

Extracts the command line of each process from the dump, the execution detail that confirms the intent of the tools found.

Run it when pslist has given you the processes and you need to know with what arguments they were running: cmdline retrieves the command line of each process from the dump — the powershell with -enc, the payload with its C2 IP, the tool with its flags. It's the context that turns the process inventory into the attack story. In memory IR, cmdline is the mandatory second step after pslist: processes say what, cmdline says why.

Don't use it as a sole source: the command line can be obfuscated (arguments with encoding, broken quotes) or the process may have modified it after startup (legitimate processes change their parameter block). In system processes, cmdline is usually empty or just the boot one — its absence is not a finding. And note: cmdline shows arguments, not code; a loader with -enc requires dumping and decoding the payload to know what it executes. Combine it with dlllist (what it loaded) and malfind (what it injected) for the full picture.