Process Monitor (Procmon)
- Sysinternals tool: real-time capture of file system, registry, process/thread, and network activity.
- Every operation is an event: process, operation, path, result, detail, timestamp.
- Filters are essential — the raw firehose is thousands of events/sec. Filter by process name or PID of the sample.
- Capture then export to
CSVfor offline scripting and diffing (feeds Lab 4).
Key Takeaway
Procmon = the microscope. Set filters first, or you drown in noise.