WinDbg !process

!process 0 0

Lists processes from the kernel with WinDbg (!process 0 0) on a memory dump, the view that no user-mode can hide.

Run it when you need the process view at kernel level: !process 0 0 walks the kernel's process list (EPROCESS) and shows each one with its PID, session, and name — including those that user-mode APIs hide (rootkits, processes unlinked from the PsActiveProcessHead list are seen with deeper variants). It's the tool for kernel analysis: on a memory dump (or in the live debugger with a kernel debugger), WinDbg gives the truth of what the system had loaded. In a high-level IR, it's the definitive confirmation when user-mode tools don't add up.

Don't use it for routine IR: WinDbg requires the correct dump (kernel dump or full memory dump with symbols) and Microsoft symbol configuration — without symbols, the output is garbage. The syntax of debugger commands (0 0, /p, /v) is cryptic for those who don't use it daily, and configuration errors (symbols, dump version) waste time. For standard process analysis, Volatility (pslist, psscan) is more accessible and sufficient; WinDbg is for when you need kernel depth or crash dump analysis. And note: the kernel process list is just that — process context (cmdline, DLLs) requires other commands and plugins.