Check periodically run files by Application [NEW]

Procmon / Procexp

In order to see if the target application runs any files that can be useful to us in the exploitation process we can use Process Monitor by SysInternals.

In order to filter out unnecessary output we can use the Filter funcionallity:

For example if you are looking for .vbs files you are able to set the following filer:

Make sure to uncheck unecessary conditions in the table below <- VERY IMPORTANT