{"id":7006,"date":"2020-03-14T00:58:30","date_gmt":"2020-03-14T00:58:30","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=7006"},"modified":"2020-03-14T01:02:12","modified_gmt":"2020-03-14T01:02:12","slug":"quick-dirty-sysmon-replacement-aka-process-hacker-logging","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/03\/14\/quick-dirty-sysmon-replacement-aka-process-hacker-logging\/","title":{"rendered":"Quick &#038; Dirty Sysmon Replacement aka Process Hacker logging"},"content":{"rendered":"\n<p>Sysmon is great, no doubt. However&#8230; very often an overkill. <\/p>\n\n\n\n<p>Yes, you&#8217;ve read this right. I say: who cares about registry writes, process access, driver or module loads, etc. ? What if we just want to log running processes?<\/p>\n\n\n\n<p>Process Hacker comes to our rescue.<\/p>\n\n\n\n<p>The <a href=\"https:\/\/wj32.org\/processhacker\/nightly.php\">recent versions<\/a> of this tool include a very handy logging capability that is available not only from a GUI level (CTRL+L keyboard shortcut), but also helps to write stuff that is &#8216;happening&#8217; directly to a log file &#8211; yes, as it happens.<\/p>\n\n\n\n<p>I find it very useful as it helps to monitor unusual activity of the system w\/o engaging the full-blown capabilities of Sysmon (performance!). And yes, I do know how weird it sounds&#8230; Sysmon cures everything&#8230;<\/p>\n\n\n\n<p>How do we set our Process Hacker instance to deliver all this goodness?<\/p>\n\n\n\n<p>We first run Process Hacker with our Admin creds. Then we open Hacker \\ Options menu item:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"275\" height=\"246\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_0.png\" alt=\"\" class=\"wp-image-7008\"\/><\/figure>\n\n\n\n<p>Then choose one of the &#8216;Notification&#8217; options and either leave it as it is (log everything) or we write down our own rules that can either include or exclude certain paths&#8230;.<\/p>\n\n\n\n<p>In the below example we include all the process names:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_1.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_1.png\" alt=\"\" class=\"wp-image-7007\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_1.png 521w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_1-300x204.png 300w\" sizes=\"(max-width: 521px) 100vw, 521px\" \/><\/a><\/figure><\/div>\n\n\n\n<p>and then we exclude notepad*.exe:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_2.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_2.png\" alt=\"\" class=\"wp-image-7009\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_2.png 637w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/ph_2-300x204.png 300w\" sizes=\"(max-width: 637px) 100vw, 637px\" \/><\/a><\/figure><\/div>\n\n\n\n<p>We can include\/exclude both processes and services. This is awesome. It&#8217;s simple, it&#8217;s working.<\/p>\n\n\n\n<p>And if you are curious where the information about these is stored, look for a `ProcessHacker.exe.settings.xml`file that lists the following:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &lt;setting name=\"ProcessHacker.ExtendedNotifications.LogFileName\">LOGFILEPATH&lt;\/setting>\n  &lt;setting name=\"ProcessHacker.ExtendedNotifications.ProcessList\">PROCESSLIST&lt;\/setting>\n  &lt;setting name=\"ProcessHacker.ExtendedNotifications.ServiceList\">SERVICELIST&lt;\/setting>\n<\/code><\/pre>\n\n\n\n<p>where PROCESSLIST\/SERVICELIST has a form of:<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow\">\n<ul><li>\\e&lt;pattern for exclusion<\/li><li>\\i&lt;pattern for exclusion <\/li><\/ul>\n<\/div><\/div>\n\n\n\n<p>That&#8217;s it really&#8230;  Nothing ground breaking, but a very handy tool for quick &amp; dirty investigations. I find it most useful to detect &#8216;funny&#8217; Windows 10 services that start &#8216;out of nowhere&#8217;. I then&#8230; usually kill them. One by one, you may eventually kill&#8217;em all&#8230; <\/p>\n\n\n\n<p>Oh yeah.. it may help with malware analysis too \ud83d\ude09 but somehow.. the analysis techniques and priorities changed a lot over last few years&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sysmon is great, no doubt. However&#8230; very often an overkill. Yes, you&#8217;ve read this right. I say: who cares about registry writes, process access, driver or module loads, etc. ? What if we just want to log running processes? Process &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/03\/14\/quick-dirty-sysmon-replacement-aka-process-hacker-logging\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[9,76,58,44,41],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7006"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7006"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7006\/revisions"}],"predecessor-version":[{"id":7013,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7006\/revisions\/7013"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7006"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7006"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}