How to find processes the sensor hooked into during a procmon capture

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Determine which processes the Carbon Black Cloud sensor hooked into during a Process Monitor capture

Environment

• Carbon Black Cloud Sensor: 3.x and Higher
• Microsoft Windows: All Supported Versions
• Process Monitor

Resolution

1. Open the procmon file in Process Monitor
2. Select the filter icon
3. Add Include options
   • "Operation is Load Image"
   • "Path ends with ctiuser.dll"
4. Click OK to apply changes

Additional Information

• This will only show processes that the sensor hooked into at the time of the procmon capture. If a process was running before the procmon started, this will not be captured.
• A boot-logger procmon can gather events hooked into during service startup