←back to thread

A Linux version of the Procmon Sysinternals tool

(github.com)
166 points LelouBil | 8 comments | 31 Aug 25 22:43 UTC | HN request time: 0s | source | bottom
1. baranul ◴[01 Sep 25 02:46 UTC] No.45088975[source]▶
Expect Microsoft to come out with more Linux tools. The demand, interest, and requests are likely to only increase.
replies(4): >>45090000 #>>45090982 #>>45091533 #>>45092514 #
2. notepad0x90 ◴[01 Sep 25 06:24 UTC] No.45090000[source]▶
They have one of the largest Linux user base out there in Azure. They have their own distro. My favorite Linux memory forensics tool (AVML) is made by them. Sysmon for Linux uses eBPF which makes it a tad-bit more powerful than auditd,etc..

If you can't beat'em join'em!

replies(2): >>45090555 #>>45092836 #
3. hdgvhicv ◴[01 Sep 25 07:56 UTC] No.45090555[source]▶
I guess they managed to get rid of the foot

http://mslinux.org/

4. JdeBP ◴[01 Sep 25 09:16 UTC] No.45090982[source]▶
One can browse from https://learn.microsoft.com/en-gb/linux/packages to see what is already there.
5. darkwater ◴[01 Sep 25 10:44 UTC] No.45091533[source]▶
This project is from 2020 [1]. The title should actually be updated to reflect that. Also we would have really go full circle if they used GPLv3 as the license :)

[1] https://github.com/microsoft/ProcMon-for-Linux/blob/main/LIC...

6. egorfine ◴[01 Sep 25 13:23 UTC] No.45092514[source]▶
I remember Steve Ballmer's Microsoft well enough to know to never touch anything Microsoft for Linux.

(All: feel free to downvote my neckbeard comment because I'm obviously in the wrong here)

replies(1): >>45094220 #
7. dotancohen ◴[01 Sep 25 14:14 UTC] No.45092836[source]▶

  > If you can't beat'em join'em!
Microsoft has a history of joining'em to beat'em. Is EEE no longer a memory?
8. spauldo ◴[01 Sep 25 16:37 UTC] No.45094220[source]▶
Yep, right there with you.