A WMI path is required to find classes associated with an instance. The WMI object path uniquely identifies a specific instance of a WMI class.
The object path is made up of a number of components:
<Namespace>:<ClassName>.<KeyName>=<Value>
The namespace can be omitted if the class is under the default namespace, rootcimv2.
The KeyName for a given WMI class can be discovered in a number of ways. In the case of Win32_Process, the key name might be discovered using any of the following methods.
It can be discovered by using the CIM cmdlets:
(Get-CimClass Win32_Process).CimClassProperties | Where-Object { $_.Flags -band 'Key' }
It can be discovered by using the MSDN website, which provides the descriptions of each property (and method) exposed by the class:
https://msdn.microsoft.com/en-us/library/aa394372(v=vs.85).aspx
Having identified a key, only the value remains to be found. In the case of Win32_Process, the key (handle) has the same value as the process ID. The object path for the Win32_Process instance associated with a running PowerShell console is, therefore:
rootcimv2:Win32_Process.Handle=$PID
The namespace does not need to be included if it uses the default, rootcimv2; the object path can be shortened to:
Win32_Process.Handle=$PID
Get-CimInstance and Get-WmiObject will not retrieve an instance from an object path, but the Wmi type accelerator can:
PS> [Wmi]"Win32_Process.Handle=$PID" | Select-Object Name, Handle
Name Handle
---- ------
powershell_ise.exe 13020