Skip to content

Instantly share code, notes, and snippets.

@ryan-leap

ryan-leap/Get-ProcessAncestry.ps1

Created October 24, 2020 13:24
Show Gist options
  • Save ryan-leap/4a0ecedce7535ed47247c73dd0bd41be to your computer and use it in GitHub Desktop.
Save ryan-leap/4a0ecedce7535ed47247c73dd0bd41be to your computer and use it in GitHub Desktop.
Download ZIP
Shows info about the current process, and it's parent, and it's parent...
Raw
Get-ProcessAncestry.ps1
$processId = $PID
do {
$thisProcess = Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = $processId"
$thisProcess | Select-Object ProcessId,ParentProcessId,Name,CreationClassName,CreationDate,CommandLine
$processId = $thisProcess.ParentProcessId
} while ($null -ne $processId)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment