Sign in to follow this  
Followers 0
gte

How to monitor on a machine, when a specific exe reads a registry file over the network?

4 posts in this topic




Maybe there's some way to automate Sysinternal's Procmon.

Share this post


Link to post
Share on other sites

I was wondering that myself. That's what I used to figure out what is happening :D

I looked through the switches for procmon and didn't see anything through the switches that could be used?

I'm wondering if I could use?

ObjGet ( "filename" [, "classname"] )

Maybe there's some way to automate Sysinternal's Procmon.

Share this post


Link to post
Share on other sites

Has anyone ever used autoit to interact with ETW or Event Tracing for Windows?

That's what procmon does

Here is a link for some C code, but this is a bit over my head I think?

http://msdn.microsoft.com/en-us/magazine/cc163437.aspx

#include <myevents.h>   // Header generated from manifest. 
                        // Contains MyProviderId and event descriptors.

REGHANDLE MyProvRegHandle;
ULONG MyInteger;
PWCHAR MyString;
ULONG MyStringLength;
EVENT_DATA_DESCRIPTOR DataDescriptor[2];

...

// Register the ETW provider.
Status = EventRegister(&MyProviderId,      // ProviderId (GUID)
                       NULL,               // Optional Callback 
                       NULL,               // OPtioanl Callback Context
                       &MyProvRegHandle);  // Registration Handle

...

// Construct DataDescriptor and write an event with 
// MyInteger and MyString.
EventDataDescCreate(&DataDescriptor[0],    // DataDescriptor
                    &MyInteger,            // Pointer to the data
                    sizeof(ULONG));        // Size of data
EventDataDescCreate(&DataDescriptor[1], &MyString, MyStringLength);

Status = EventWrite(MyProvRegHandle,       // Registration Handle
                    MyEventDescriptor1,    // EventDescriptor
                    2,                     // DataDescriptor array size
                    DataDescriptor);       // DataDescriptor array

...

// Write another event with no user data.
if (EventEnabled(MyProvRegHandle, MyEventDescriptor2)) {
    // Do extra work if enabled and write event.
    ...

    Status = EventWrite(MyProvRegHandle, MyEventDescriptor2, 0, NULL);
}

...

// Unregister the ETW provider. 
Status = EventUnregister(MyProvRegHandle);

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0