0

I'm trying to automate usage of procmon and I would like to specify arbitrary filters. I see that you can do that from the command line by loading a .pmc file with /loadconfig. So I am supposing I can generate my own .pmc then launch procmon.

However, I'm unable to understand the format.

Can anyone give some guidance on how to create my own .pmc file? If not, is there an option to load a pmf file through command line (because I have been able to generate a pmf file through python script)

1

The PMC file is the result of you exporting the Procmon configuration once you have it setup.

  • Launch Procmon
  • Configure your filters
  • Test them to make sure they work the way you want them to
  • Set your History Depth to what you want; I suggest 1
  • Enable Drop Filtered Events

Once everything is set the way you want, export the Configuration to a PMC file to save the settings and allow you to use them in command line.

Now, when launching Procmon via command line, you will need to use this syntax:

Procmon.exe /BackingFile C:\temp\PM.PML /LoadConfig c:\temp\pm.pmc /quiet

Change the drive and path, obviously, to suit your specific environment.

If you do not use /quiet, the tool will prompt you to confirm filters every launch.

Resources: https://technet.microsoft.com/sysinternals/processmonitor.aspx

Hope this helps.

  • 1
    I assume that you mean /quiet. – Scott Feb 14 '17 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.