Check running processes and services

ad privescwindowschecklist

Walkthrough

List running processes and service binary paths. A hit is a non-default service running with high privileges or a binary in a writable location.

powershell

Get-Process; Get-CimInstance -ClassName win32_service | Select Name,State,PathName