Save your capture files by going to “File > Save”. You should see events showing up in your window. You can start capturing events by going to “File” and checking “Capture Events”. Using Process MonitorĪfter opening ProcMon, you will see a window like this. Run Procmon.exe to open up the application. Installing Process Monitorīut first, let’s install ProcMon! Go to Microsoft’s website to download Process Monitor.Įxtract the downloaded file “ProcessMonitor.zip” to your desktop. Today, we are going to go through the basics of using ProcMon. Security professionals use it to monitor critical processes and spot potentially malicious behavior.

Sysadmins often use ProcMon to troubleshoot issues that are otherwise hard to detect on the operating system. Some tools available today that provide similar levels of detail in real-time about the operating system are SpyStudio.exe, Sysmon.exe, Procexp.exe, and perfmon.exe. The two tools combined to form the earliest version of ProcMon “Process Monitor”. Process Monitor was born when Mark Russinovich and Bryce Cogswell created RegMon “Registry Monitor” and its sister application Filemon “File Monitor”.

You can view process, registry, filesystem, and network activity in real-time. Process Monitor is a tool on Windows systems that helps you monitor for issues on your system.

Using procmon