Procmon: When you filter to a registry path, do you need to specify the exact value?

Question

In procmon, if you filter to a registry path like so:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler

Then change a value in this path, such as the "start" value, this change is not captured in Procmon. However, if you filter to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Start

Then change the start value, this is captured. Is this expected behavior? Our first assumption is the first filter would show changes to all values in that path.

Answer 1

It depends on the conditions that you selected. If you selected "is" then it might not be picked up. If you selected "begins with" or "contains", then I would expect it to be captured.