Forensic Investigation Tools
Process Monitor Tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
Process Monitor Introduction
Process Monitor is a powerful system monitoring tool provided by Sysinternals, which is a suite of advanced system utilities developed by Microsoft. The primary purpose of Process Monitor is to capture and display real-time information about various system events, including file system activity, registry access, network activity, and process-related events. In the context of forensic investigations, Process Monitor can be a valuable tool. Forensic analysts can use it to track and analyze the behavior of applications, processes, and system components during a specific time frame. It helps in identifying suspicious or malicious activities, understanding the sequence of events leading to a particular incident, and gathering evidence for analysis
Some key features of process monitor
- File System Activity: Monitors file and directory operations, including opens, closes, reads, writes, and deletions.
- Registry Activity: Captures operations on the Windows Registry, such as key opens, reads, writes, and deletions.
- Network Activity: Displays information about network events, including TCP/IP connections, DNS queries, and more.
- Process and Thread Activity: Provides details about the creation and termination of processes and threads.
- Filtering and Search: Allows users to apply filters to focus on specific processes, events, or activities. It also supports search functionality.
Process Monitoring Examples
You can download process monitor as part of the sysinternals package in the windows store. Once downloaded, when you open the tool, ou will be able to see the process that are carrying out activities in real time.
We can also filter the processes and exclude others that might be distracting. To do this click on the filter button and then select the process name on the drop down. you should then click on the drop down and change from include to exclude. Type the process name you want removed from the list and click add. Click on Apply to view the changes.
When we compare the screenshot below from the first one, you will see that all explorer.exe processes have been removed from the view.
If we only want to view what one process has been doing, we can use the same filter but change to include. We can click add and Apply to view the changes. We will be able to only see the process according to what we filtered with, in this case the process name.
In this example of process monitor, I have limited it to only show the lsass.exe and this is what we are viewing.
We can filter process based on what activities that the system might be carrying out. From the first to the last arrow, this is what we can filter
- The first arrow on the left shows the button to filter processes with registry actions.
- The second arrow from the left shows us the button to filter any file system activity.
- The middle arrow is for processes with some network activity.
- The fourth arrow shows processes with thread activity.
- The last arrow shows processes with profiling activity.
The process monitor shows details for each process running including the IP addresses it might be contacting, the file it might be opening, the service or port that might be used and so on. This could be a handy section for finding processes that might be accessing your files and any activity that might look suspicious.
