.. / Get-CimInstance

Gets the CIM instances of a class from a CIM server


Functions:
Type:
Toolsets:

Processes

Get instances of a CIM class

Get-CimInstance -CimSession $s -ClassName Win32_Process
Usecase
List running processes

Comments
Mitre Att&ck
T1047

Get instances of a CIM class

Get-CimInstance -ClassName Win32_Process | % { [PSCustomObject]@{Name=$_.Name; User=$(Invoke-CimMethod -InputObject $_ -MethodName GetOwner).User } }
Usecase
List running processes including username

Comments
Mitre Att&ck
T1047


Manage

Get instances of a CIM class

Get-CimInstance -Filter 'Name="TermService"' -ClassName Win32_Service -CimSession $s
Usecase
Obtain the “Remote Desktop Services” service instance. This can now for example be used to launch or stop the service

Comments
Mitre Att&ck
T1047




Updated: 2023-07-01
Contributor: Arris Huijgen (bitsadmin)