Hi

How do you create a process sensor that looks at the commandline (startup parameters for the process) and not the exe file?

have mutible processes that runs with the same .exe file, so the only way to select the ones i want to monitor is to look at the commandline.

are there an easy way to do this?

Regards Christian Grevsen, Mark Information

Article Comments

Hello Christian,

I'm afraid we have no sensor for this particular scenario, as the WMI Process Sensor's query for example is only able to retrieve the name of a process, but not the eventually applied bunch of parameters that were used to start it.

Kind regards,

Erhard


Sep, 2018 - Permalink

Hi Christiaan,

Using the Win32_Process class you can write your own Custom Sensor retrieving various process info based on the process name and command line parameters.

The WMI querie could be beased on something like:

select * from win32_process where name = "my_processname" and commandline = "my_parameters"

Sep, 2018 - Permalink