Trace pwsh.exe with Process Monitor — partial notes

Review the recorded Process Monitor setup for tracing pwsh.exe file and registry activity. The required PMF filter attachment is held, so the import sequence cannot be completed from this page alone.

1. Install Process Monitor Download Process Monitor As Zip File
2. GoTo: https://learn.microsoft.com/en-us/sysinternals/downloads/procmon Click the download link and save the download to Save To: %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor.zip
3. Extract the Zip File and it will create a ProcessMonitor folder %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor
4. Open Pwsh and create
5. a EventExport folder New-Item -type Directory -Path "$($ENV:UserProfile)\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\EventExport"
6. a FilterConfig folder New-Item -type Directory -Path "$($ENV:UserProfile)\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\FilterConfig"
7. How To Open Process Monitor

Open the Run box (Press WindowsKey + R)

Paste the following and press OK %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\Procmon64.exe

NOTE: If the Capture play button is Blue then Process Monitor is actively watching your device.

Screenshot retained for review

1. Deselect "Enable Advanced Output" This makes the filter options easier to understand

Screenshot retained for review

1. Import the filter attachment (held)
2. The source requires WatchPwshByPID_FileAndReg.PMF, which remains held. Its recorded save location is to %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\FilterConfig\
3. Import the PMF file In the top ProcessMonitor menu, Click Filter -> Organize Filters Click the "Import…" button Select the PMF file from "%userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\FilterConfig\WatchPwshByPID_FileAndReg.PMF"

Screenshot retained for review

1. **EDIT THE FILTER Ctrl + L (to open the filter editor)

Deselect the lines in the filter where the**

• Column contains PID,
• Value cotains RedRenameKey, RegReplaceKey or RegSetValue
• Value contains "Disposition: Create"

Update the "Date & Time" entries. Note: (You can deselect both of the Date & Time lines and come back later)

• START TIME: Is the "Date & Time" where "Action = Include"
• END TIME: Is the "Date & Time" where "Action = Exclude"

Select Apply.

Find the PID of the pwsh process to follow, then adjust the PID row in the filter.

NOTES: The source excludes Offset because it showed chunks transferred during an internet download. Including "Disposition: Create" should help reduce your output to files that were actually created.

1. Save/Export the Event Results
2. File -> Save
3. Under Format select: Comma-Seperated Values (CSV)
4. PATH %userprofile%\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\EventExport\ProcessLog_For_InsertUsefulTitle.CSV
5. Press the OK button
6. *Show List of Files From CSV csvFilePath =** "($ENV:Userprofile)\OneDrive - Christian Community Ministries\Documents\ProcessMonitor\EventExport*ProcessLog_For_InsertUsefulTitle.CSV" $files = import-csv **$csvFilePath #Exclude from output

Captured CSV-filter fragment

The following fragment excludes Windows/PowerShell paths and registry entries. Its formatting is incomplete; it is retained as reference text, not a tested export-processing script.

• Windows system and PowerShell 7 files/folders

• Registry entries

$uniqueFileList = $files.Path | Select -Unique | Where {$_ -notlike "HK*" -and $_ -notlike ":\Windows*" -and $_ -notlike ":\Program Files\PowerShell\7*"} #Output will show files and folder that were involved with your PID process $uniqueFileList | Out-Host

PROCESS MONITOR FILTER SAVED AS ATTACHMENT

Attachment retained for review

Screenshot retained for review

Related guidance

• Topic overview
• Source review status