Process Monitor — authorized lab orientation
Process Monitor (Procmon) (Microsoft Sysinternals) is the usual Windows lab tool for answering "what did this process touch?" Use it only on systems you are authorized to monitor.
Snapshot
| Field | Value |
|---|---|
| Publisher | Microsoft Sysinternals |
| Job | Real-time process / file / registry / network event tracing |
| Suite map | Sysinternals Suite overview |
| Persistence peer | Autoruns |
| Process UI peer | Process Hacker / System Informer |
Allowed framing
- Capturing a filtered trace while a student-built app reads/writes files under a lab profile.
- Exporting CSV/PML into the case binder with the filter definition attached.
- Teaching "drop noise first" so IR classes do not drown in
CreateFilespam.
Scope we will not cover
- No credential / token theft recipes.
- No anti-Procmon or anti-forensics cookbooks.
- No production monitoring without a ticket / authorization window.
- No crack/keygen framing.
Beginner path (authorized only)
- Install Procmon from official Sysinternals channels on a lab VM.
- Start a tiny app you wrote; apply a process-name filter before reproducing the bug/behavior.
- Export the filtered trace; hash the export; store beside authorization notes.
- If the question is persistence across reboot, switch to Autoruns.
- If the question is code-level, graduate to x64dbg / WinDbg under the same authorization.
- Use Procmon for authorized Windows event triage, not as a debugger substitute.
- Prefer tight filters + exported Evidence over hour-long unfiltered captures.
- Refuse credential theft, anti-forensics and crack framing.
For legal, authorized and educational use only.
FAQ
What does Process Monitor capture?
Procmon records real-time file system, registry, process/thread and network activity (per current Microsoft docs) for troubleshooting on Windows. It is not a disassembler.
Do I need a kernel debugger?
No for ordinary Procmon labs. Procmon is a Sysinternals utility; deep kernel debugging is a different toolchain (WinDbg). Stay inside authorization either way.
How do filters help?
Unfiltered traces grow huge. Filter early by process name, path or operation so Evidence stays reviewable. Save filter sets with the case notes.
Boot logging?
Boot-time capture exists for advanced troubleshooting — confirm current UI/docs for your Procmon build and only enable it on lab VMs you own. Expect large logs and stricter change control on shared hosts.
Does this teach hiding malware from Procmon or stealing credentials?
No. Authorized triage and education only — BinBench will not supply anti-forensics, credential theft or DRM-bypass cookbooks.