PowerShell Get-CimInstance process enumeration via Edgecution native host (command 6)

Duo Tech@duotech

•updated Aug 5, 2026•1•0•1

Detects PowerShell invoking Get-CimInstance against Win32_Process to enumerate running processes (ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine), converting output to compressed JSON, when spawned by or related to python.exe or cmd.exe -- consistent with the Edgecution native host's process-enumeration command (command 6).