Team: Huntress Managed Endpoint Detection and Response (EDR)
Product: EDR/RIO
Environment: Windows
Summary: This guide covers how to use Process Monitor (Procmon) to gather additional information on conflicts or unexpected behavior with EDR/RIO and other applications. Process conflicts can arise when multiple applications or processes attempt to access the same system resources, such as files, registry keys, or network ports, causing issues like crashes, freezing, or unexpected behavior.

Using Procmon to gather additional information for our Engineering team. 

Please read the entire guide before starting to become familiar with the process. Some of these steps must be followed quickly to prevent unnecessary information from being gathered.

Step 1: Download and Extract Procmon

1. Download Procmon: If you haven’t already, download Procmon from the official Microsoft Sysinternals site: Download Process Monitor.
2. Extract Procmon: Locate the Procmon downloaded file, then "right click" on the folder to extract it to your preferred location.

Step 2: Verify that RIO is running on the target host

1. Open Task Manager on the host.
2. Scroll down to see if Huntress Rio Agent is running.
   

Step 3: Start Procmon to gather additional information

1. Navigate to the location where you previously extracted the ProcessMonitor folder.
2. Open the folder, then double-click on Procmon.
   You may encounter a pop-up box asking, "Do you want to allow this program to make changes to your device?" if so, select YES.
3. As soon as Procmon starts running, it will automatically start gathering information. In the top bar, Show Registry Activity, Show File System Activity, Show Network Activity, and Show Process and Thread Activity are enabled by default. Show Profiling Events is disabled. We are mainly looking for Show Process and Thread Activity. If the others are enabled by default, please make sure to toggle them off so the log file does not grow too large. 

Step 4: Open the application that you previously encountered unexpected behavior with. 

1. Navigate to and open the Application or Program where unexpected behavior was encountered.

Step 5: Pause, Save, and Send us the information

1. Pause the recording: In the top bar of Procmon, you will see an icon that looks like a Play Button. Select this icon  to pause the recording after the unexpected behavior is encountered.
2. Save: Select "File" then "Save" from the Process Monitor Menu at the top. Save the file to a location that you can easily locate. The preferred file type is (PML).
3. Send: Attach the saved file to your next reply with Support on the ticket. 
   Please use the Carbon Copy (CC) filed and enter the Support representative's email address. This ensures that our technician receives the attachment regardless of file size.