Windows Server

Detect registry keys – Process Monitor “SysInternal Tools”

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more.

Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

This tool can be downloaded from here https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

Extract the downloaded tool and run the Procmon64.exe as shown below.

Next, after running the executable, agree to the Process Monitor License Agreement.

This will launch the Process Monitor SysInternal Tool as shown below.

Note: This tool is memory intensive

Below are some possibilities that are available with this tool. Here you can choose to include or exclude the program, highlight etc.

Also, with the “Jump to Object (contl+J)”, you can jump directly to the registry keys associated as shown below

This tool is capable or has the following features

  • Capturing (Screenshots)
  • Auto scrolling
  • Filter
  • Highlight
  •  Show Process tree
  • Include Process from Windows
  • Find
  • Jump to Object
  • Show Registry Activity
  • Show File System Activity
  • Show Network Activity
  • Show Process and Trend Activity
  • Show profiling event.

Emphasizing on the show registry activities, we will have to click on a process name and select.

Lastly, when you click on the Show Process and Trend Activity, this will apply even filter as shown below and give the desired output on the Process Monitor window.

Find: With the find function, you can easily find process (events) in the process monitor.

Without this, having to search in the numerous process will be cumbersome as you can see below.

Filter: With filter, you can also perform filter in order to include on your desired process on the Process Monitor UI.

  • Click on filter, enter your desired parameters,
  • click on Add, Select the program to include and click on Ok.

Since our filter included just one process, other processes were excluded as shown below.

Note: When this filter is set, you will have to manually reset it before you can perform other activities correctly again.

For a tour on SysInternal tools, see https://techdirectarchive.com/2020/01/25/windows-sysinternals-tools-psexec-and-auto-logon/

Advertisements

Leave a Reply

%d bloggers like this: