Process Monitor (Procmon) Cheatsheet
What It Is
Real-time file system, registry, and process/thread monitoring tool from Sysinternals.
Why It Matters
The single most important tool for observing malware behavior during dynamic analysis.
Quick Start
- Launch Procmon (as Administrator)
- Set filters before execution (reduce noise)
- Execute malware sample
- Analyze captured events
Essential Filters
| Filter | Purpose |
|---|---|
| Process Name is [malware.exe] → Include | Focus on target process |
| Operation is WriteFile → Include | File modifications |
| Operation is RegSetValue → Include | Registry changes |
| Path contains Run → Include | Persistence indicators |
| Path contains Temp → Include | Dropped files |
Key Shortcuts
Ctrl+E– Toggle captureCtrl+X– Clear displayCtrl+L– Open filter dialogCtrl+T– Process tree viewCtrl+H– Toggle highlight
Common Mistakes
- Not filtering before capture (millions of events)
- Forgetting to run as Administrator
- Not saving PML files for later review
- Missing child process activity
Pro Tip
Use Process Tree view (Ctrl+T) to see parent-child process relationships at a glance.