I was looking how to automate procmon on CI and found this (but info there might be bit outdated, had to reset my procmon registry to get it back to work) - https://gist.github.com/balaprasathr/ae424eec0e9e2860aa84a85... and whole article that goes deep into it - but can't find it now - I think I've stumbled on to it from the link above.