For example, to view the Process with the name “Procmon.exe”, you can set the filter conditions to “Process name is Procmon.exe then Include”. You can filter events by process ID, username, time, date, and more. You can also adjust which events are shown in your window using more detailed filters by going to “Filter > Filter…”. To quickly switch between event types you can use the buttons located in the top toolbar. ProcMon filters allow you to filter specific events and exclude the ones that you don’t want to see. ProcMon gives you the option of saving only filtered events and saving the capture file in multiple different formats. Save your capture files by going to “File > Save”. You should see events showing up in your window. You can start capturing events by going to “File” and checking “Capture Events”. Using Process MonitorĪfter opening ProcMon, you will see a window like this. Run Procmon.exe to open up the application. Installing Process Monitorīut first, let’s install ProcMon! Go to Microsoft’s website to download Process Monitor.Įxtract the downloaded file “ProcessMonitor.zip” to your desktop. Today, we are going to go through the basics of using ProcMon. Security professionals use it to monitor critical processes and spot potentially malicious behavior. Sysadmins often use ProcMon to troubleshoot issues that are otherwise hard to detect on the operating system. Some tools available today that provide similar levels of detail in real-time about the operating system are SpyStudio.exe, Sysmon.exe, Procexp.exe, and perfmon.exe.

The two tools combined to form the earliest version of ProcMon “Process Monitor”. Process Monitor was born when Mark Russinovich and Bryce Cogswell created RegMon “Registry Monitor” and its sister application Filemon “File Monitor”. You can view process, registry, filesystem, and network activity in real-time. Process Monitor is a tool on Windows systems that helps you monitor for issues on your system.

Sysinternals procmon