A ProcMon Logs (PML) Analyzer.
CI (via AppVeyor)
Please note that this is a work-in-progress and most likely will always be.
SeeBee is a (currently command-line only) tool to parse the ProcMon Logs (PML) which is in a binary format. Although PMLs can be read by ProcMon itself, the filtering and querying capabilities of the tool is very limited.
SeeBee uses ProcMon to convert the PML to XML and then enables filtering on top of the XML data. Currently, the filtering engine supports a limited subset of properties and filtering mechanisms.
SeeBee is currently a CMD only version. Eventually, I plan to add a GUI and improve the filtering engine.
Without further ado, here's how: SeeBeeCmd pm "C:\T\SeeBee\Procmon.exe" in "C:\T\SeeBee\Logfile.PML" c "C:\T\SeeBee\SeeBee.sbc" where,
- pm -> path to the ProcMon executable
- in -> the input PML or XML file
- c -> the configuration file for SeeBee
The config file - .SBC (SeeBeeConfig) is a simple XML file and can be edited with any text editor. Below is an example:
<?xml version="1.0" encoding="UTF-8"?>
<SeeBee>
<Filters>
<Create>
<Filter name="DefaultUserProcesses" appliesOn="Processes" property="ProcessName" operator="Equals">
notepad.exe, explorer.exe, iexplore.exe, firefox.exe, chrome.exe
</Filter>
<Filter name="DefaultSystemProcesses" appliesOn="Processes" property="ImagePath" operator="StartsWith">
gpupdate.exe, conhost.exe, svchost.exe, winlogon.exe, csrss.exe, lsass.exe, WUDFHost.exe, spoolsv.exe, unsecapp.exe
</Filter>
<Filter name="RunningProcesses" appliesOn="Processes" property="FinishTime" operator="Equals">
0
</Filter>
<Filter name="CompletedProcesses" appliesOn="Processes" property="FinishTime" operator="NotEquals">
0
</Filter>
<Filter name="HasLoadedWindowsDlls" appliesOn="Processes" property="Modules" operator="Contains">
user32.dll, advapi32.dll
</Filter>
<Filter name="SomeGenericProcesses" appliesOn="Events" property="Operation" operator="Equals">
"Load Image", QueryBasicInformationFile
</Filter>
<Filter name="SomeGenericProcesses" appliesOn="Events" property="Operation" operator="Equals">
"Load Image", QueryBasicInformationFile
</Filter>
</Create>
<Conditions>
<Condition action="Exclude" operator="And">
DefaultUserProcesses, DefaultSystemProcesses
</Condition>
<Condition action="Include" operator="Or">
RunningProcesses, HasLoadedWindowsDlls
</Condition>
<Condition action="Include" operator="Only">
HasLoadedWindowsDlls
</Condition>
</Conditions>
</Filters>
</SeeBee># of Events that match the criteria: 108.
Press any key to continue...
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent