Start here
Basic listing
No arguments gives you image name, PID, session, and memory. The power is in the switches — /svc, /m, and /fi — and in reading the output against what's normal.
tasklistEvery running process — image name, PID, session name, session #, and memory use.tasklist /vVerbose — adds the running user, CPU time, window title, and status. The user column is the useful add.tasklist /fo tableForce the classic table layout (the default). list and csv are the other formats.tasklist | find /i "powershell"Quick check whether a named process is running — pipe to find.tasklist /fi "PID eq 4812"Look up a single PID — pair it with a network tool that gave you the owning process.Core
Filters (/fi)
Stack multiple /fi clauses; operators are eq, ne, gt, lt, and ge/le.
tasklist /fi "imagename eq svchost.exe"All instances of one image. Great for counting how many svchost or checking for a second lsass.tasklist /fi "username eq NT AUTHORITY\SYSTEM" /vEverything running as SYSTEM. Odd names here deserve a look.tasklist /fi "status eq running"Running (vs. Not Responding). Also status eq not responding.tasklist /fi "memusage gt 200000"Processes using more than ~200 MB (value is in KB). Spot memory hogs.tasklist /fi "sessionname eq Console"Processes on the interactive console session vs. Session 0 services.tasklist /fi "imagename eq cmd.exe" /fi "username ne SYSTEM"Stack filters — here, shells not owned by SYSTEM.tasklist /fi "windowtitle ne N/A" /vProcesses with a visible window — separates interactive apps from background services.Deep look
Services, DLLs & apps
tasklist /svcMaps each PID to the services it hosts — the way to see what's actually inside every svchost.exe.tasklist /mLists the DLLs (modules) loaded by every process. Big output — usually filter it.tasklist /m wininet.dllWhich processes loaded a specific DLL. A non-browser with wininet / winhttp is worth a second look.tasklist /m /fi "imagename eq explorer.exe"Modules loaded by one process — spot an injected or side-loaded DLL.tasklist /appsWindows Store (UWP) apps and their package IDs (Win10+).Fleet
Remote hosts
tasklist /s SRV01Run against a remote host by name or IP (needs rights and RPC reachable).tasklist /s SRV01 /u DOMAIN\admin /pSupply alternate credentials; /p without a value prompts for the password.tasklist /s 10.0.0.5 /svc /fi "imagename eq svchost.exe"Remote service-to-PID map on a suspect host — triage without logging in.Reading
Output formats
tasklist /fo csvCSV — pipe into a file or a spreadsheet for a ticket.tasklist /fo csv /nh > procs.csv/nh drops the header row; redirect to save a clean process snapshot.tasklist /fo list /vOne field per line — easiest to read for a single process's full detail.tasklist /v /fo csv | findstr /i "cmd powershell wscript"CSV piped to findstr — grab just the interpreters, with their user column.Put it together
SOC one-liners
Reading a live box against known-normal. Compare counts, parents (with another tool), paths, and users.
tasklist /fi "imagename eq lsass.exe"There should be exactly one lsass.exe. Two is one too many.tasklist /svc /fi "imagename eq svchost.exe"Every svchost and the services it hosts — a svchost hosting nothing is suspicious.tasklist /v /fo csv | findstr /i "cmd.exe powershell.exe wscript.exe mshta.exe"Find the interpreters and who's running them — the usual living-off-the-land binaries.tasklist /m /fi "imagename eq <proc>.exe" | findstr /i "wininet winhttp ws2_32"Network-capable DLLs inside a process that shouldn't be talking to the internet.tasklist /v /fo csv | findstr /vi "NT AUTHORITY"Everything not running as a system account — narrows to user-context processes fast.tasklist /s SRV01 /fi "imagename eq <suspect>.exe" /fo listConfirm a suspected process is present on another host before you touch it.tasklist /fo csv /nh > \\share\%COMPUTERNAME%.csvSnapshot every host's process list to a share for offline diffing across the fleet.What tasklist can't show: the parent process and the full image path — the two things you most need to spot a masquerade. For those, use wmic process get Name,ProcessId,ParentProcessId,ExecutablePath, PowerShell (Get-CimInstance Win32_Process), or Process Explorer. Then check names against the Core Processes sheet.