Oneliners For Procmon Debugging of AWS Cloud Formation Automation

Search for a command to run...

No comments yet. Be the first to comment.
Why Least Privilege Security Engineering Is Frequently Skipped or Done Loosely In a previous life, I was on a team that reviewed the IAM policies specified by developers when they created new Cloud applications or required additional permissions for ...

Obscuring sensitive information like AWS account IDs in screenshots and videos is tedious and error-prone. Even with video editing tools that simplify the process, I still have to repeatedly add and remove blurring boxes as the view changes. You know...

AWS CloudShell joins the ranks of hostless shells for operating in your cloud environment. Cloud shells are a huge help to training and enablement scenarios because they remove the pain of fussy configuration of a user-owned endpoint - which can have...

This article is the third and final of a series. Part 1 justified that human-performed DevOps checklists are essentially source code, and according to GitOps principles, belong in Git just like any other code required for successfully managing a soft...

There are always those who feel checklists are an unnecessary waste of time because they think they can always remember the basics of the steps involved to complete a task. Many are also not aware of the huge, cross-discipline benefits that can come ...

I was working through some nasty Windows automation problems buried deep in a Cloud Formation template.
Something appeared to be overwriting a certificate private key that we were placing on the system.
The block of automation code that might contain the offending lines is a complex salt configuration.
Being able to automatically enable a procmon trace for just that segment of code would be very handy since I can’t manually trace the automation and it would prevent me from having to trace the entire setup from start to end.
The first oneliner downloads procmon if it is not already present, launch it to do a trace.
The second oneliner terminates the trace.
The examples below are coded as Cloud Formation “commands” that use PowerShell - but you can technically use them anywhere you can kick off PowerShell.
Happy bug hunting!
The following oneliner is shown as a cfn-init command because that can be the most syntactically challenging to devise, however, it can be used anywhere. This oneliner is NOT reboot resilient. For a trace to start during a boot, add the parameter /EnableBootLogging and reboot. /EnableBootLogging does NOT persist through multiple reboots.
2-download-and-start-procmon:
command: |
powershell.exe -ExecutionPolicy Unrestricted -command Invoke-WebRequest -Uri https://live.sysinternals.com/Procmon.exe -Outfile c:\windows\temp\procmon.exe ; Start-Process -FilePath c:\windows\temp\procmon.exe -ArgumentList '/Quiet /AcceptEula /Minimized /BackingFile c:\windows\temp\ProcmonCapture.pml' ; Start-Sleep 10 ; Write-Output "STARTED: Procmon Trace: c:\windows\temp\ProcmonCapture.pml"
The following oneliner is shown as a cfn-init command because that can be the most syntactically challenging to devise, however, it can be used anywhere.
5-stop-procmon:
command: |
powershell.exe -ExecutionPolicy Unrestricted -command Start-Process -FilePath c:\windows\temp\procmon.exe -ArgumentList '/Terminate' ; Write-Output "COMPLETED: Procmon Trace: c:\windows\temp\ProcmonCapture.pml"
This code is also part of the PSHDeepExecutionDebugging repository: https://github.com/DarwinJS/DebugDeepPSHExecution