> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/monitoring-users/procmon-capturing-commands.md).

# Procmon - Capturing Commands

Use Process Monitor to capture short-lived process launches and recover full command lines on Windows.

Procmon, short for **Process Monitor**, is a Windows **Sysinternals** tool. It captures real-time process, file system, registry, and thread activity. For command capture, the most useful event is `Process Create`.

That event shows the image path, parent process, user context, and full command line. It helps when commands are too fast to catch live or never land in shell history.

### Why use it

* Catch short-lived `cmd.exe` or `powershell.exe` launches.
* See what a user, service, or scheduled task actually runs.
* Recover arguments, file paths, and sometimes credentials passed on the command line.

{% hint style="warning" %}
Procmon is noisy by default. Add filters before you start recording, or useful events disappear in the flood.
{% endhint %}

### Example usage

Use this workflow when you want to capture commands a logged-in user or background process is launching.

{% stepper %}
{% step %}

### Start Procmon as Administrator

Launch Procmon and accept the driver prompt. Press `Ctrl+E` to stop the live capture, then `Ctrl+X` to clear old events.
{% endstep %}

{% step %}

### Add focused filters

Open **Filter** and include `Operation` **is** `Process Create`.

Then add process names you care about, such as:

* `cmd.exe`
* `powershell.exe`
* `pwsh.exe`

If needed, also filter on a specific `User`, `Parent PID`, or path.
{% endstep %}

{% step %}

### Start capture and wait for activity

Press `Ctrl+E` again to resume capture. Let the target user or process perform the action you want to observe.
{% endstep %}

{% step %}

### Review the command line

Open a matching `Process Create` event and inspect the **Command line** field in the event details. That usually gives you the exact binary, flags, script path, and parent process.
{% endstep %}
{% endstepper %}

### Sample result

A useful hit often looks like this:

```
Process Name: powershell.exe
Operation: Process Create
Parent Process: explorer.exe
Command line: powershell.exe -ExecutionPolicy Bypass -File C:\Users\jdoe\Desktop\backup.ps1 -Target \\fileserver\share
```

From a single event, you can learn:

* what launched the process
* which script or binary ran
* which arguments matter for follow-on access or escalation

### Official link

Procmon does not have an official Windows GitHub repository. It is published through Microsoft Sysinternals.

* [Process Monitor homepage and download](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon)