BlackhawkHub

COMMAND

tasklistList running processes

tasklist lists the processes running on a Windows machine with their process ID (PID), session and memory use. Filter with /fi to find a specific PID or image name, and use /svc to see which services each process hosts, which is essential for understanding svchost.exe.

BlackhawkHub Editorial · Updated

Purpose

tasklist is Task Manager for the command line: it enumerates running processes and their basic properties, and it filters, which makes it the standard way to turn a PID from netstat into a program name.

Basic use

cmd
tasklist
text
Image Name          PID Session Name  Session#  Mem Usage
================= ===== ============ ========= ==========
svchost.exe        1234 Services            0    12,004 K
explorer.exe       5678 Console             1   142,880 K

Find a specific process

cmd
tasklist /fi "PID eq 8210"
tasklist /fi "IMAGENAME eq chrome.exe"
tasklist /fi "MEMUSAGE gt 500000"

The filters (/fi) accept PID, IMAGENAME, MEMUSAGE, STATUS, SESSION, USERNAME and more, with operators eq, ne, gt, lt.

See hosted services

cmd
tasklist /svc

This maps each process to the services it hosts, which is the only way to see what a given svchost.exe instance is actually running. Combine with a PID filter to inspect one instance.

Verbose and formatted output

cmd
tasklist /v
tasklist /fo csv /nh > processes.csv

/v adds the window title, CPU time and user; /fo csv suits export.

Remote query

cmd
tasklist /s SERVER01 /u DOMAIN\admin /p

Common mistakes

  • Quoting filters wrongly. The whole filter expression is one quoted string: /fi "PID eq 8210".
  • Expecting per-service memory from a shared svchost; the process total covers all its services.

PowerShell equivalent

Get-Process lists processes as objects; Get-Process -Id 8210 targets a PID; Get-CimInstance Win32_Service | Where-Object ProcessId -eq 1234 shows the services a PID hosts.

Frequently asked questions

How do I find the process using a specific PID?

tasklist /fi "PID eq 8210". Combined with netstat -ano (which gives the PID owning a port), this identifies which program holds a port.

How do I see which services run inside svchost.exe?

tasklist /svc lists each process with the services it hosts. For a specific svchost PID: tasklist /svc /fi "PID eq 1234". See the svchost.exe record.

Sources

Port records

Port 8080 HTTP alternatePort 8080 is the IANA-registered alternative to port 80 (http-alt). It is widely used by HTTP…

Command records

taskkill Stop a process or process treetaskkill stops a running process by its PID (/PID) or image name (/IM). Add /F to force…netstat Active connections and listening portsnetstat shows the machine's active TCP and UDP connections and the ports it is listening on.…Get-NetTCPConnection List TCP connections as objectsGet-NetTCPConnection lists the machine's TCP connections and listening ports as PowerShell…sc Query and control Windows servicessc (service control) queries and manages Windows services from the command line. sc query…systeminfo Report system configurationsysteminfo prints a summary of a Windows machine: OS name, version and build, install date,…whoami Show the current user, groups and privilegeswhoami prints the current user account in domain\user form. With options it shows much more:…net use Map and manage network drivesnet use connects a Windows machine to a shared folder over SMB, optionally mapping it to a…

Process records

svchost.exe Service Hostsvchost.exe (Service Host) is a legitimate Windows process that hosts services which run from…RuntimeBroker.exe Runtime BrokerRuntimeBroker.exe (Runtime Broker) is a Windows process that checks and enforces permissions…dwm.exe Desktop Window Managerdwm.exe (Desktop Window Manager) composites everything you see on the Windows desktop: window…lsass.exe Local Security Authority Subsystem Servicelsass.exe (Local Security Authority Subsystem Service) enforces the security policy on…csrss.exe Client Server Runtime Subsystemcsrss.exe (Client Server Runtime Subsystem) is an essential Windows process that manages…MsMpEng.exe Antimalware Service Executable (Microsoft Defender)Antimalware Service Executable, the process MsMpEng.exe, is the core engine of Microsoft…conhost.exe Console Window Hostconhost.exe (Console Window Host) provides the window, text rendering, selection and modern…