Skip to content
HackIndex logo

HackIndex

Windows Service and Process Enumeration

3 min read Jul 14, 2026

Services and processes reveal what is running on the target, under which identity, and with what permissions. Misconfigured services are among the most common privilege escalation paths on Windows. Process enumeration tells you what security tools are active and which user contexts are available for token theft.

Running processes

PS C:\Users\Guest\Desktop> # All processes
PS C:\Users\Guest\Desktop> tasklist /v
PS C:\Users\Guest\Desktop> Get-Process
 
PS C:\Users\Guest\Desktop> # Processes with owner
PS C:\Users\Guest\Desktop> Get-Process -IncludeUserName | Select-Object Name, Id, UserName, Path | Sort-Object UserName
 
PS C:\Users\Guest\Desktop> # Processes with service associations
PS C:\Users\Guest\Desktop> tasklist /svc
 
PS C:\Users\Guest\Desktop> # Check for security tools
PS C:\Users\Guest\Desktop> tasklist | findstr /i "defender crowdstrike sentinel cylance carbon cbdefense tanium symantec mcafee sophos"
 
PS C:\Users\Guest\Desktop> # Find processes running as SYSTEM or admin accounts
PS C:\Users\Guest\Desktop> Get-Process -IncludeUserName | Where-Object {$_.UserName -match 'SYSTEM|Administrator|Domain'} | Select-Object Name, Id, UserName

Service enumeration

Enumerate all services with their binary paths, run-as accounts, and start types. Services running as SYSTEM with weak permissions are direct escalation paths.

PS C:\Users\Guest\Desktop> # All services with details
PS C:\Users\Guest\Desktop> sc query type= all state= all
PS C:\Users\Guest\Desktop> Get-Service | Select-Object Name, DisplayName, Status, StartType
 
PS C:\Users\Guest\Desktop> # Services with binary paths and run-as accounts
PS C:\Users\Guest\Desktop> Get-WmiObject Win32_Service | Select-Object Name, DisplayName, State, StartMode, PathName, StartName | Sort-Object StartName
 
PS C:\Users\Guest\Desktop> # Services running as SYSTEM
PS C:\Users\Guest\Desktop> Get-WmiObject Win32_Service | Where-Object {$_.StartName -eq 'LocalSystem'} | Select-Object Name, PathName
 
PS C:\Users\Guest\Desktop> # Services running as non-standard accounts (interesting for cred hunting)
PS C:\Users\Guest\Desktop> Get-WmiObject Win32_Service | Where-Object {$_.StartName -notmatch 'LocalSystem|NetworkService|LocalService|NT AUTHORITY'} | Select-Object Name, PathName, StartName

Service permission checking

Services with overly permissive ACLs allow low-privilege users to modify the binary path and escalate to SYSTEM. Check permissions on both the service itself and its binary.

PS C:\Users\Guest\Desktop> # accesschk — check service permissions for current user
accesschk.exe /accepteula -uwcqv $USER *
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
accesschk.exe /accepteula -uwcqv "Everyone" *
 
# Check binary file permissions for all services
Get-WmiObject Win32_Service | ForEach-Object {
$path = $_.PathName -replace '"',''
$path = ($path -split ' ')[0]
if (Test-Path $path) {
$acl = Get-Acl $path
$acl.Access | Where-Object {
$_.IdentityReference -match 'Users|Everyone|Authenticated' -and
$_.FileSystemRights -match 'Write|FullControl|Modify'
} | ForEach-Object {
Write-Host "Writable binary: $path ($($_.IdentityReference))"
}
}
}
 
# Unquoted service paths (spaces without quotes)
Get-WmiObject Win32_Service | Where-Object {$_.PathName -notmatch '"' -and $_.PathName -match ' '} | Select-Object Name, PathName

Writable service binaries lead to Service Binary Hijacking. Unquoted paths lead to Unquoted Service Path Privilege Escalation. Weak service permissions lead to Weak Service Permissions Privilege Escalation.

Scheduled tasks

PS C:\Users\Guest\Desktop> # All non-Microsoft tasks
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft*"} | Select-Object TaskName, TaskPath, State
 
# Task details including action and run-as account
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft*"} | ForEach-Object {
$task = $_
$info = Get-ScheduledTaskInfo -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
[PSCustomObject]@{
Name = $task.TaskName
RunAs = $task.Principal.UserId
Action = ($task.Actions | Select-Object -First 1).Execute
LastRun = $info.LastRunTime
}
}
 
# Check permissions on task scripts
schtasks /query /fo LIST /v | findstr /i "task to run run as"