This tool is a way to view data collected from ProcessMonitor and load it into a UI that hopefully helps researchers work more efficiently. Today I’m releasing a tool in which i’ve given a very vague name called MonitorUI. Anyone can use json for additional tooling! Fortunately, this is why Objective-See uses json as its output mode. I look at the Activity Monitor and 'pkd' is usually over 100 CPU usage practically every time. When I'm using Safari, whether it's typing an email or filling out a form or researching something, the page freezes or I got the spinning beach ball. You get pretty good at it after a lot of practice, but it still isn’t overly practical when doing a long session of reversing or research. The 'pkd' process, a lot of the time is at the top of the list on the Activity Monitor. I often find myself pinpointing a process of interest, and then using cmd+f in a text editor in order to find a previous event that it caused, find its parent, or find its children.

Until now!īeing able to view process data in raw text is great, but it certainly isn’t easy on the eyes. This json output can then easily be displayed in other tools, and yet it doesn’t seem that anyone has taken the time to write any. Honestly, an underrated little tool that uses the Apple Endpoint Security Framework to record executed processes and return the details in a nicely formatted json string. Perhaps my favorite tool used to track processes in a hurry is Objective-See’s ProcessMonitor. For this reason, I have about a million and one different ways in which I like to monitor process activity on macOS. For those that read my in depth coverage on low-level process hunting or any of my blogposts on TrueTree, you know that I’m a stickler for process hunting on macOS.

Macos process monitor