How can I use "or" logic with Process Monitor's Filters and Highlight rules? (aka "any" vs "all")

Dai 31 Reputation points
2026-10-29T22:08:03.1333333+00:00

As far as I can tell, Process Monitor's Filter and Highlight rules are all applied together as "and" rules (i.e. a row must satisfy all criteria, as opposed to any criteria, or a subset or sub-group of criteria).

For example, in a Process Monitor session, I might want to highlight all activity from Outlook.exe, in addition to all activity in any other processes concerning my %homepath%\Desktop directory - currently this is impossible:

  • ...instead, if you were to set two Highlight rules: 1) ProcessName equals "Outlook.exe" and 2) Path contains "C:\Users\Me\Desktop" then Process Monitor will only highlight rows where Outlook itself touches my desktop.
  • The same applies to the Include/Exclude Filter criteria.
  • It's also unclear what the precedence of Include and Exclude rules are (e.g. if you have only Include rules in your Filter criteria, then are non-matching rows implicitly Excluded, or do I always need an explicit Exclude criteria?)

I appreciate that it would be nontrivial to implement a full GUI Filter Editor (like this) for setting arbitrary AND/OR rules with grouping, and such a UI tends to be tedious to use too, instead I'd be very satisfied if there were a free-form textbox for typing in rules directly, perhaps as C-style expressions or PowerShell-style (akin to Excel's PowerQuery M editor), so my above imagined highlight rule for "Outlook.exe activity - and anything looking at my Desktop" could be entered as:

( Path -contains "\Desktop" ) || ( ImageName -equals "Outlook.exe" )

As a stretch-goal, if it isn't too much to ask, I'd like to be able to have separate, multiple highlight rules, each with their own color.

Sysinternals
Sysinternals

Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.

0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.