Skip to content

Instantly share code, notes, and snippets.

@mgeeky
Last active November 5, 2024 22:16
Show Gist options
  • Save mgeeky/f0d13172d557e5860c0301dbf847de60 to your computer and use it in GitHub Desktop.
Save mgeeky/f0d13172d557e5860c0301dbf847de60 to your computer and use it in GitHub Desktop.
PROCMON Operations list
CloseFile
CreateFile
CreateFileMapping
DeviceIoControl
FileSystemControl
FlushBuffersFile
Load Image
LockFile
NotifyChangeDirectory
Process Create
Process Exit
Process Profiling
Process Start
RegFlushKey
RegUnloadKey
QueryAllInformationFile
QueryAttributeInformationVolume
QueryAttributeTagFile
QueryBasicInformationFile
QueryDeviceRelations
QueryDirectory
QueryEAFile
QueryFileInternalInformationFile
QueryFullSizeInformationVolume
QueryInformationVolume
QueryNameInformationFile
QueryNetworkOpenInformationFile
QueryNormalizedNameInformationFile
QueryObjectIdInformationVolume
QueryOpen
QueryPositionInformationFile
QueryRemoteProtocolInformation
QuerySecurityFile
QuerySizeInformationVolume
QueryStandardInformationFile
QueryStreamInformationFile
ReadFile
RegCloseKey
RegCreateKey
RegDeleteKey
RegDeleteValue
RegEnumKey
RegEnumValue
RegLoadKey
RegOpenKey
RegQueryKey
RegQueryKeySecurity
RegQueryMultipleValueKey
RegQueryValue
RegSetInfoKey
RegSetKeySecurity
RegSetValue
SetAllocationInformationFile
SetBasicInformationFile
SetDispositionInformationFile
SetDispositionInformationEx
SetEndOfFileInformationFile
SetPositionInformationFile
SetRenameInformationFile
SetSecurityFile
SetStorageReservedIdInformation
TCP Accept
TCP Connect
TCP Disconnect
TCP Receive
TCP Reconnect
TCP Retransmit
TCP Send
TCP TCPCopy
Thread Create
Thread Exit
UDP Receive
UDP Send
UnlockFileSingle
QueryEaInformationFile
WriteFile
QueryDeviceInformationVolume
QueryNetworkPhysicalNameInformationFile
@fourteen-1
Copy link

Would be neat for the not so tech-savvy to get short explanation of each operation.

@Smorgan05
Copy link

Alas this is missing values

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment