07-21-2023, 09:01 PM
You can check how powershell was called using [**`Get-WmiObject`**](
```powershell
(gwmi win32_process | ? { $_.processname -eq "powershell.exe" }) | select commandline
#commandline
#-----------
#"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -NonInteractive
```
---
UPDATE: 2020-10-08
> Starting in PowerShell 3.0, this cmdlet has been superseded by [**`Get-CimInstance`**](
```powershell
(Get-CimInstance win32_process -Filter "ProcessID=$PID" | ? { $_.processname -eq "pwsh.exe" }) | select commandline
#commandline
#-----------
#"C:\Program Files\PowerShell\6\pwsh.exe"
```
[To see links please register here]
) for WMI objects:```powershell
(gwmi win32_process | ? { $_.processname -eq "powershell.exe" }) | select commandline
#commandline
#-----------
#"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -NonInteractive
```
---
UPDATE: 2020-10-08
> Starting in PowerShell 3.0, this cmdlet has been superseded by [**`Get-CimInstance`**](
[To see links please register here]
)```powershell
(Get-CimInstance win32_process -Filter "ProcessID=$PID" | ? { $_.processname -eq "pwsh.exe" }) | select commandline
#commandline
#-----------
#"C:\Program Files\PowerShell\6\pwsh.exe"
```