Finding Hidden PowerShell Applications

The most widely known PowerShell hosts are certainly powershell.exe and powershell_ise.exe because they ship out-of-the-box. However, there can be many more (and hidden) PowerShell hosts running. Any software that instantiates the PowerShell engine is a PowerShell host. This could be Visual Studio Code (with the PowerShell extension installed), Visual Studio, or any other similar software.

Command to List All Currently Running PowerShell Hosts

To find out all currently running PowerShell hosts, run this:

Get-ChildItem -Path "\\.\pipe\" -Filter '*pshost*' |
    ForEach-Object {
        $id = $_.Name.Split('.')[2]
        if ($id -ne $pid)
        {
            Get-Process -ID $id
        }
    }

The result may look like this:

 
Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName                                      
-------  ------    -----      -----     ------     --  -- -----------                                      
   1131     101   628520      42440             11216   0 SupportAssistAgent                               
   1011      82   269920     299208      85,30  17420   1 powershell_ise                                   
    520      29    68012      75880       1,23  33532   1 powershell                                       
    590      31    69508      77712       2,02  36636   1 powershell                                       
    545      27    67952      76668       1,14  37584   1 powershell                                       
   4114     654   801136     965032     129,69  28968   1 devenv    

Visual Studio Code

“SupportAssistAgent” was opened by Visual Studio Code, and “devenv” represents the internal PowerShell host launched by Visual Studio.

ReTweet this Tip!