Process Monitor is a powerful system monitoring tool provided by Sysinternals, which is a suite of advanced system utilities developed by Microsoft. The primary purpose of Process Monitor is to capture and display real-time information about various system events, including file system activity, registry access, network activity, and process-related events. In the context of forensic investigations, Process Monitor can be a valuable tool. Forensic analysts can use it to track and analyze the behavior of applications, processes, and system components during a specific time frame. It helps in identifying suspicious or malicious activities, understanding the sequence of events leading to a particular incident, and gathering evidence for analysis
You can download process monitor as part of the sysinternals package in the windows store. Once downloaded, when you open the tool, ou will be able to see the process that are carrying out activities in real time.
We can also filter the processes and exclude others that might be distracting. To do this click on the filter button and then select the process name on the drop down. you should then click on the drop down and change from include to exclude. Type the process name you want removed from the list and click add. Click on Apply to view the changes.
When we compare the screenshot below from the first one, you will see that all explorer.exe processes have been removed from the view.
If we only want to view what one process has been doing, we can use the same filter but change to include. We can click add and Apply to view the changes. We will be able to only see the process according to what we filtered with, in this case the process name.
In this example of process monitor, I have limited it to only show the lsass.exe and this is what we are viewing.
We can filter process based on what activities that the system might be carrying out. From the first to the last arrow, this is what we can filter
The process monitor shows details for each process running including the IP addresses it might be contacting, the file it might be opening, the service or port that might be used and so on. This could be a handy section for finding processes that might be accessing your files and any activity that might look suspicious.