What it does
Process Monitor records Windows filesystem, registry and process or thread activity with non-destructive filtering and detailed event properties.
Process Monitor is useful when an action happens too quickly to inspect manually. Its event trace can connect a process with the files or registry settings it accesses. Capture a bounded reproduction and use non-destructive filters to focus the review. Keep the original trace so another investigator can revisit events outside the first filter. Large captures become difficult to interpret, so a clear question and time window are more useful than recording indefinitely.
Strengths
- Detailed activity traces with non-destructive filtering
Best for
- Analysts tracing suspicious or unexplained Windows behavior
Sources
- Process Monitor - Sysinternals | Microsoft Learn (Oct 26, 2026)