Documentation Index
Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt
Use this file to discover all available pages before exploring further.
invoke-processhunter uses WMI Win32_Process queries to search across all domain computers — or a specified subset — for running processes that match a given name or are owned by target users. The command first enumerates computers from the domain controller via LDAP, then dispatches workers to query each host in turn. This makes it useful for locating where a specific tool (such as mmc.exe or powershell.exe) is running, or confirming that a target user has an active process on a remote machine prior to lateral movement. Multi-threading is supported to speed enumeration across large environments.
Process enumeration relies on WMI
Win32_Process queries, which require local administrator rights on the target host. Non-admin accounts will receive an access-denied error and the host will be skipped.Flags
Domain Controller Connection
IP address of the domain controller used to enumerate target computers and users via LDAP.
Name of the domain to authenticate with.
Username for authentication.
Password associated with the specified username.
NTLM hashes for pass-the-hash authentication. Format:
[LMHASH:]NTHASH.Use Kerberos authentication. Reads credentials from the
KRB5CCNAME ccache file.Force a TLS connection to the domain controller.
Target Computer Selection
One or more specific hostnames or IPs to hunt against (space-separated). Skips LDAP computer enumeration when provided.
Path to a file containing hostnames or IPs to query, one per line.
Custom LDAP filter applied when querying computers from the domain controller.
ADS path to use when searching for computers in LDAP.
Domain to query for target machines.
Target User / Process Selection
One or more process names to search for (space-separated). Matching is case-insensitive and uses substring comparison. When omitted, all processes owned by target users are returned.
Name of a domain group whose members to use as target users.
Hunt for processes owned by this specific username.
Custom LDAP filter applied when querying target users from the domain controller.
ADS path used when searching for target users in LDAP.
Path to a file containing usernames to use as targets, one per line.
Use the local administrators of this server as the target user list.
Hunt Behaviour
Number of parallel worker threads to use when querying target hosts. Default:
1.Stop hunting as soon as the first matching process is found.
Return all processes found, not just those matching target users or process names.
Logging verbosity sent to stderr. Choices:
CRITICAL (default), WARNING, DEBUG, ULTRA.Print results as JSON instead of the default human-readable format.