I'm trying to automate usage of procmon and I would like to specify arbitrary filters. I see that you can do that from the command line by loading a .pmc file with /loadconfig. So I am supposing I can generate my own .pmc then launch procmon.
However, I'm unable to understand the format.
Can anyone give some guidance on how to create my own .pmc file? If not, is there an option to load a pmf file through command line (because I have been able to generate a pmf file through python script)
1 Answer
The PMC file is the result of you exporting the Procmon configuration once you have it setup.
- Launch Procmon
- Configure your filters
- Test them to make sure they work the way you want them to
- Set your History Depth to what you want; I suggest 1
- Enable Drop Filtered Events
Once everything is set the way you want, export the Configuration to a PMC file to save the settings and allow you to use them in command line.
Now, when launching Procmon via command line, you will need to use this syntax:
Procmon.exe /BackingFile C:\temp\PM.PML /LoadConfig c:\temp\pm.pmc /quietChange the drive and path, obviously, to suit your specific environment.
If you do not use /quiet, the tool will prompt you to confirm filters every launch.
Resources:
Hope this helps.
1
