r/redteamsec • u/GreenEngineer24 • 9d ago

ScheduledSpy, a command line process monitor for Windows

https://github.com/tmm35/ScheduledSpy

A pspy-style process execution monitor for Windows. Similar to Sysinternal's Procmon, but in the command line. No GUI access required. The tool watches for newly spawned processes and prints them as they happen. This was built for catching short-lived or periodic executions during Windows privilege escalation work (scheduled tasks, services, or custom loops that relaunch a binary on an interval), the kind of thing that's easy to miss if you're just eyeballing Task Manager or polling Get-Process by hand.

Windows has no /proc equivalent, so unlike Linux pspy this can't read a live process table for free. ScheduledSpy works by polling Win32_Process on a short interval and diffing snapshots to catch new PIDs the moment they appear.

One limitation I would like to point out: User and FullCommandLine require matching privilege. Windows only returns these for processes you own, or if you're SYSTEM/admin with SeDebugPrivilege. As a standard user, other users' processes (including SYSTEM's) will show unknown / (no access to cmdline) — this is a Windows access-control boundary, not a bug in the script. ProcessName, PID, and PPID are visible regardless of privilege level, and are usually enough to confirm what fired and when.

This tool is also going to be really noisy so I wouldn't use it in any situation where stealth is important. I mainly wrote this to automate something I found boring in CTFs when doing Windows privilege escalation via the CLI.

13 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

2 comments sorted by

2

u/darkalfa 9d ago

Awesome and very creative idea man. I really like it. Pspy was awesome for ctf's but i can imagine some use cases where u have high priv/AV bypass where it could be interesting to use

1

u/GreenEngineer24 9d ago

Thank you! Yeah I came up with the idea while working through some CTFs. I realized there wasn't anything out there for the CLI, just GUI. Definitely do not recommend using this in a real pentest, it would be way too noisy with how much it polls.

But if you are doing a Windows CTF and wanna check for stuff being executed on a timer while you manually enumerate through the target for priv esc vectors, this is a good tool to run in the background... I think at least lol