let' fire up our process monitoring script and then create some processes to see what the output looks like :\python process_monitor py ,justin- trl ld\administrator, :\windows\system notepad exe," :\windows\system \notepad exe, , , / ,justin- trl ld\administrator, :\windows\system calc exe," :\windows\system \calc exe, , , / after running the scripti ran notepad exe and calc exe you can see the information being output correctlyand notice that both processes had the parent pid set to which is the process id of explorer exe in my vm you could now take an extended break and let this script run for day and see all of the processesscheduled tasksand various software updaters running you might also spot malware if you're (un)lucky it' also useful to log out and log back in to your targetas events generated from these actions could indicate privileged processes now that we have basic process monitoring in placelet' fill out the privileges field in our logging and learn little bit about how windows privileges work and why they're important