# Trace pwsh.exe with Process Monitor — partial notes

Review the recorded Process Monitor setup for tracing pwsh.exe file and registry activity. The required PMF filter attachment is held, so the import sequence cannot be completed from this page alone.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

1.  **Install Process Monitor Download Process Monitor As Zip File**
2.  **GoTo:** <https://learn.microsoft.com/en-us/sysinternals/downloads/procmon> Click the download link and save the download to **Save To:** %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor.zip
3.  **Extract the Zip File and it will create a ProcessMonitor folder** %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor
4.  **Open Pwsh and create**
5.  a **EventExport** folder New-Item -type Directory -Path "$($ENV:UserProfile)\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\EventExport"
6.  a **FilterConfig** folder New-Item -type Directory -Path "$($ENV:UserProfile)\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\FilterConfig"
7.  **How To Open Process Monitor**

Open the Run box (Press WindowsKey + R)

Paste the following and press OK %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\Procmon64.exe

**NOTE:** If the Capture play button is Blue then Process Monitor is actively watching your device.

[Screenshot retained for review](../../review/Review-status.md#asset-f22141229253bbf4d767)

1.  **Deselect "Enable Advanced Output"** This makes the filter options easier to understand

[Screenshot retained for review](../../review/Review-status.md#asset-8511a9554d50659a226a)

1.  **Import the filter attachment (held)**
2.  **The source requires** WatchPwshByPID_FileAndReg.PMF, which remains held. Its recorded save location is to %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\FilterConfig\\
3.  **Import the PMF file** In the top ProcessMonitor menu, Click Filter -\> Organize Filters Click the "Import…" button Select the PMF file from "%userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\FilterConfig\WatchPwshByPID_FileAndReg.PMF"

[Screenshot retained for review](../../review/Review-status.md#asset-bcca7339439e33f0db13)

1.  \*\*EDIT THE FILTER Ctrl + L (to open the filter editor)

Deselect the lines in the filter where the\*\*

- Column contains PID,
- Value cotains RedRenameKey, RegReplaceKey or RegSetValue
- Value contains "Disposition: Create"

**Update the "Date & Time" entries. Note:** (You can deselect both of the Date & Time lines and come back later)

- **START TIME**: Is the "Date & Time" where "Action = **Include**"
- **END TIME**: Is the "Date & Time" where "Action = **Exclude**"

Select **Apply**.

Find the PID of the pwsh process to follow, then adjust the PID row in the filter.

**NOTES:** The source excludes Offset because it showed chunks transferred during an internet download. Including "Disposition: Create" should help reduce your output to files that were actually created.

1.  **Save/Export the Event Results**
2.  **File -\> Save**
3.  **Under Format select: Comma-Seperated Values (CSV)**
4.  **PATH %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\EventExport\ProcessLog_For_InsertUsefulTitle.CSV**
5.  **Press the OK button**
6.  **Show List of Files From CSV $csvFilePath =** "$($ENV:Userprofile)\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\EventExport\**ProcessLog_For_InsertUsefulTitle.CSV**"
    **$files** = import-csv \*\*\$csvFilePath \#Exclude from output

## Captured CSV-filter fragment

The following fragment excludes Windows/PowerShell paths and registry entries. Its formatting is incomplete; it is retained as reference text, not a tested export-processing script.

- Windows system and PowerShell 7 files/folders

- Registry entries

**$uniqueFileList** = **$files**.Path \| Select -Unique \| Where {\$\_ -notlike "HK\*" -and \$\_ -notlike "*:\Windows\*" -and \$\_ -notlike "*:\Program Files\PowerShell\7\*"} \#Output will show files and folder that were involved with your PID process **\$uniqueFileList** \| Out-Host

## PROCESS MONITOR FILTER SAVED AS ATTACHMENT

[Attachment retained for review](../../review/Review-status.md#asset-0108a65e60265b2ce2db)

[Screenshot retained for review](../../review/Review-status.md#asset-b98f867ba136c4665557)

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)