{
	"id": "5158b72b-6c8a-4e26-8080-e2f0e3b67b2b",
	"created_at": "2026-04-06T00:18:56.56811Z",
	"updated_at": "2026-04-10T03:22:03.492491Z",
	"deleted_at": null,
	"sha1_hash": "fc914848e230bd1314fe9be49c3c3a3de1f3615d",
	"title": "Tasklist",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 57486,
	"plain_text": "Tasklist\r\nArchived: 2026-04-05 23:07:06 UTC\r\nDisplays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a\r\nremote computer.\r\ntasklist[.exe] [/s computer] [/u domain\\user [/p password]] [/fo {TABLE|LIST|CSV}] [/nh] [/fi FilterName\r\n[/fi FilterName2 [ ... ]]] [/m [ModuleName] | /svc | /v] \r\n/s   Computer   : Specifies the name or IP address of a remote computer (do not use backslashes). The default is\r\nthe local computer.\r\n/u   Domain \\ User   : Runs the command with the account permissions of the user specified by User or\r\nDomain\\User. The default is the permissions of the current logged on user on the computer issuing the command.\r\n/p   Password   : Specifies the password of the user account that is specified in the /u parameter.\r\n/fo { TABLE | LIST | CSV } : Specifies the format to use for the output. Valid values are TABLE, LIST, and\r\nCSV. The default format for output is TABLE.\r\n/nh   : Suppresses column headers in the output. Valid when the /fo parameter is set to TABLE or CSV.\r\n/fi   FilterName   : Specifies the types of process(es) to include in or exclude from the query. The following table\r\nlists valid filter names, operators, and values.\r\nName Operators Value\r\nStatus eq, ne RUNNING|NOT RESPONDING\r\nImagename eq, ne Any valid string.\r\nPID\r\neq, ne, gt, lt,\r\nge, le\r\nAny valid positive integer.\r\nSession\r\neq, ne, gt, lt,\r\nge, le\r\nAny valid session number.\r\nhttps://technet.microsoft.com/en-us/library/bb491010.aspx\r\nPage 1 of 3\n\nName Operators Value\r\nSessionName eq, ne Any valid string.\r\nCPUTime\r\neq, ne, gt, lt,\r\nge, le\r\nValid time in the format of hh:mm:ss. The mm and ss parameters should be\r\nbetween 0 and 59 and hh can be any valid unsigned numeric value.\r\nMemusage\r\neq, ne, gt, lt,\r\nge, le\r\nAny valid integer.\r\nUsername eq, ne Any valid user name ([Domain\\]User).\r\nServices eq, ne Any valid string.\r\nWindowtitle eq, ne Any valid string.\r\nModules eq, ne Any valid string.\r\n/m [ ModuleName ] : Specifies to show module information for each process. When a module is specified, all the\r\nprocesses using that module are shown. When a module is not specified, all the processes for all the modules are\r\nshown. Cannot be used with the /svc or the /v parameter.\r\n/svc   : Lists all the service information for each process without truncation. Valid when the /fo parameter is set to\r\nTABLE. Cannot be used with the /m or the /v parameter.\r\n/v   : Specifies that verbose task information be displayed in the output. Cannot be used with the /svc or the /m\r\nparameter.\r\n/? : Displays help at the command prompt.\r\nTasklist is a replacement for the TList tool.\r\nThe following examples show how you can use the tasklist command:\r\ntasklist /v /fi \"PID gt 1000\" /fo csv\r\ntasklist /fi \"USERNAME ne NT AUTHORITY\\SYSTEM\" /fi \"STATUS eq running\"\r\ntasklist /v /fi \"STATUS eq running\"\r\nhttps://technet.microsoft.com/en-us/library/bb491010.aspx\r\nPage 2 of 3\n\ntasklist /s srvmain /nh\r\ntasklist /s srvmain /s srvny\r\ntasklist /s srvmain /u maindom\\hiropln /p p@ssW23 /nh\r\nFormat Meaning\r\nItalic Information that the user must supply\r\nBold\r\nElements that the user must type exactly as\r\nshown\r\nEllipsis (...)\r\nParameter that can be repeated several times in a\r\ncommand line\r\nBetween brackets ([]) Optional items\r\nBetween braces ({}); choices separated by pipe (|).\r\nExample: {even|odd}\r\nSet of choices from which the user must choose\r\nonly one\r\nCourier font Code or program output\r\nSource: https://technet.microsoft.com/en-us/library/bb491010.aspx\r\nhttps://technet.microsoft.com/en-us/library/bb491010.aspx\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://technet.microsoft.com/en-us/library/bb491010.aspx"
	],
	"report_names": [
		"bb491010.aspx"
	],
	"threat_actors": [],
	"ts_created_at": 1775434736,
	"ts_updated_at": 1775791323,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/fc914848e230bd1314fe9be49c3c3a3de1f3615d.pdf",
		"text": "https://archive.orkl.eu/fc914848e230bd1314fe9be49c3c3a3de1f3615d.txt",
		"img": "https://archive.orkl.eu/fc914848e230bd1314fe9be49c3c3a3de1f3615d.jpg"
	}
}