Series 4: Ep 8: Memory Matters

Dig deep into system memory! Learn how to illustrate the memory layout of a basic program and use advanced PowerShell commands (WMI, security-focused queries) todebug, check process integrity, detect DLL injections, and identify suspicious processes on Windows Server 2022.Commands:Get-Process | Where-Object { $_.ProcessName -eq "notepad" }Get-WmiObject -Class Win32_OperatingSystem | Select-Object TotalVisibleMemorySize, FreePhysicalMemoryGet-ProcessGet-WmiObject -Class Win32_Process | Select Name, ProcessId, ExecutablePath. For new powershell version simply use: Get-Process | Select-Object Name, Id, PathGet-WmiObject -Class Win32_Process | Select-Object Name, ProcessId, ParentProcessIdGet-WmiObject -Class Win32_Process -Filter "Name = 'notepad.exe'" | Select-Object ProcessId, Name, @{Name='Owner';Expression={$_.GetOwner().User}}Get-Process -Name notepad | Select-Object -ExpandProperty Modules | Select ModuleName, FileNameGet-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -and ($_.ExecutablePath -notlike "C:\Windows\*" -and $_.ExecutablePath -notlike "C:\Program Files\*") } | Select Name, ProcessId, ExecutablePathGet-Process | Where-Object { $_.Modules.ModuleName -contains "ntdll.dll" }Get-WmiObject Win32_Process | Select-Object Name, ProcessId, CommandLineGet-Process | Sort-Object StartTime -Descending | Select-Object Name, Id, StartTime | Select-Object -First 10