Malware › Module 6 › Lesson 3
Proc Monitor Literacy
Process monitor literacy — read Procmon/Sysmon-style events in $MAL_LAB output, parent-child chains, file and registry writes.
Visual · t22_proc_monitor_literacy
Proc monitor = process/file/registry timeline. $MAL_LAB output. Original Cyberlium.
Opening
Blue teams live in process trees — learn to read what spawned what without treating every log line as malware gospel.
Process monitor tools capture real-time OS activity: process create/exit, file read/write, registry modifications, thread and image loads. Analyst literacy filters noise — exclude known-good baseline, focus on sample PID subtree, correlate UTC timestamps with network capture. Key fields: Process Name, PID, Parent PID, Path, Operation, Result, Detail. Cyberlium teaches reading $MAL_LAB detonation exports — NOT installing stealth rootkits to 'test Procmon,' NOT running monitors on production endpoints without authorization, NOT publishing raw logs with internal hostnames unredacted. Purple value: one behavior row → one detection hypothesis for defenders.
1. Event categories
Process Create: Image, Command Line, Parent — map who launched the sample. File Write: path under Temp, AppData, Startup — persistence hints.
Registry SetValue: Run keys, services, COM hijack paths — name classes, not export weaponized persistence scripts.
Command guide
Try these commands — Event categories
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Lab VM isolation — https://any.run/ (preferred dynamic analysis) Hybrid Analysis — https://www.hybrid-analysis.com/ (submit benign lab files only if policy allows)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal cat > "$HOME/cyberlium-lab/t22-mal/notes/pre-detonation.txt" <<'EOF' baseline_captured: ss + journalctl BEFORE any sample run detonation: isolated VM / cloud sandbox ONLY host_os: REFUSE unknown binaries EOF
Command — copy this
grep -E 'baseline|REFUSE|detonation' "$HOME/cyberlium-lab/t22-mal/notes/pre-detonation.txt" ss -tulpn 2>/dev/null | wc -l
Primary tools to practice this lesson: ss, grep. Reference sites: Lab VM isolation (https://any.run/); Hybrid Analysis (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Filtering discipline
Filter by sample PID or path prefix; exclude analyst tools and Windows noise where possible.
UTC timestamps align with PCAP and dynamic lab timeline — single source of truth for report.
3. Detection handoff
Translate suspicious rows to defender language: 'unsigned binary from Temp spawned cmd.exe with encoded args.'
Redact user paths and internal IPs before any share — chmod 600 until ticket opened.
4. What you ship: proc monitor literacy card
Five event types + filter rule + parent-child read method + redaction rule.
5. What you record before the next lesson
Proc monitor literacy card path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Export full Procmon log with home username paths to public forum.
Right
Proc monitor literacy card from $MAL_LAB export. Next: Dynamic Lab.
Mission: proc monitor literacy card
1) Define Process Create row fields. 2) Name three suspicious file write patterns. 3) Write filter-by-PID rule. 4) Redaction rule for share.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Parent PID vs Command Line — which tells more?”
Knowledge Check
APPLY: Proc monitor literacy focuses on:
Multiple choice
Knowledge Check
APPLY: True or False: Publish raw Procmon with unredacted paths.
True or False
Knowledge Check
APPLY: Parent PID helps you:
Multiple choice