.. / query.exe

Displays information about processes, sessions, and Remote Desktop Session Host servers


Functions:
Type:
Toolsets:

Sessions

List listeners and interactive sessions

query.exe session /server:W10.ad.bitsadmin.com
Usecase
Reconnaissance on currently active sessions

List logged in users

query.exe user /server:W10.ad.bitsadmin.com
Usecase
Reconnaissance on currently active users

List terminal servers on the network

query.exe termserver


Processes

List all processes

query.exe process /server:W10.ad.bitsadmin.com *
Usecase
Reconnaissance on running processes

Mitre Att&ck
T1057

List all processes

query.exe process /server:W10.ad.bitsadmin.com keepass.exe
Usecase
Identify specific running process

Mitre Att&ck
T1057




Updated: 2023-07-01
Contributor: Arris Huijgen (bitsadmin)