procmon.exe

procmon.exe /BackingFile <file>.pml

Logs real-time process activity with Process Monitor: registry, files, network, and processes in an analyzable log.

Run it when you need to see what a process does live: procmon logs every operation — registry keys read and written, files opened, network connections, and processes created — with the result of each operation. In malware analysis (or of a suspicious binary), procmon with a process filter is the local behavior tool: the dropper touching the Run key, writing the payload, and connecting. In live IR, procmon on the compromised process documents its activity before isolating the host. The /BackingFile saves the log in .pml for later analysis without losing anything.

Don't use it without filters: procmon without configuration logs thousands of operations per second (Windows noise) — the filter by process, operation, or path is mandatory, and the unfiltered log is unmanageable. On hosts with EDR, capturing with procmon can interfere or generate alerts (procmon is known). And watch out: procmon sees local behavior, not deep network or kernel — connections appear, encrypted content doesn't; and malware with anti-analysis detects procmon and changes its behavior. For malware analysis, the sandbox remains the environment; procmon is for the suspicious live host or manual analysis.