Lion Cipher Lab
Read a Procmon capture: the files, registry keys, and processes a sample touched
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Process Monitor is the DFIR analyst's microscope on a Windows host: it records every file, registry and process/thread operation in real time. The problem is that 'every operation' means a firehose — well over a million events in a couple of minutes on an idle box — and a sample's malicious behaviour is maybe ten of them. Anyone can click Capture. The skill that actually pays is READING the result: filtering the noise away, isolating the handful of events that matter, and reconstructing from them exactly what the sample did to the machine. This drill hands you a real-shaped capture from an…
What you'll learn
- reading the seven Process Monitor columns (Time, Process Name, PID, Operation, Path, Result, Detail)
- filtering a million-event capture down to the ~10 events that describe a sample's behaviour
- filtering by process name, by Operation (WriteFile / RegSetValue / Process Create / TCP Connect), and by Result
- mapping Procmon operations to malware behaviours: dropper, persistence, child process, C2 callback
- reconstructing a behaviour timeline from raw host telemetry
- extracting IOCs (dropped file, Run-key value, C2 IP and domain) from a capture
- mapping observed behaviour to MITRE ATT&CK techniques
- judgment: when granular host telemetry is the right lens and when it drowns you
Steps in this lab
- The scene: one sample, an isolated sandbox, and a capture full of noise
- Read the columns: what each field in a Procmon row means
- WHEN this host telemetry is the right lens — and WHEN it drowns you
- Meet the firehose: an unfiltered slice
- Filter #1 — by process name: keep only the target
- Filter #2 — by Operation: keep only the behaviours that matter (and WHY these four)
- Filter #3 — by Result: what SUCCESS vs NAME NOT FOUND tells you
- Reconstruct the behaviour timeline
- Pull the IOCs
- How a pro does it better: filter FIRST, snapshot before, correlate with a capture