What is Sysmon?
Sysmon, short for System Monitor, is a free tool in Microsoft's Sysinternals suite that records security-relevant activity on Windows machines in far more detail than the built-in logs. It installs as a system service backed by a kernel driver, begins recording early in the boot process and keeps running across reboots. Everything it captures goes to its own event log channel, Microsoft-Windows-Sysmon/Operational, where Event Viewer, Windows Event Forwarding or a SIEM agent can pick it up.
Sysmon is mainly an observer. Recent versions can be set to stop executable files from being written to chosen folders, but it doesn't kill processes, quarantine files or raise alerts by itself. Its value is the data it produces, which analysts and detection rules then search.
The event IDs analysts use most
| Event ID | What it records | Why it helps |
|---|---|---|
| 1 | Process creation, with the full command line, parent process, user and file hashes | Shows exactly what ran and what launched it |
| 3 | Network connection, with the process, addresses and ports | Ties a connection to the program that made it |
| 7 | A DLL or other image loaded into a process | Exposes DLL side-loading and unusual modules |
| 8 | CreateRemoteThread: one process starting a thread inside another | A common sign of code injection |
| 10 | One process opening another, such as LSASS | Catches credential theft tools reading LSASS memory |
| 11 | File created | Shows dropped payloads and staged data |
| 12 to 14 | Registry keys and values created, deleted, changed or renamed | Reveals persistence such as Run keys |
| 22 | DNS query, with the process that made it | Links lookups of suspicious domains to a program |
How Sysmon is configured
Sysmon is driven by an XML configuration file that says which events to record and which to filter out. Logging every DLL load and every connection on a busy server creates huge volume, so most organizations start from a community-maintained baseline configuration and tune it: exclude noisy, known-good activity and keep the areas attackers tend to touch. The same binary installs and updates it. sysmon64.exe -accepteula -i sysmonconfig.xml installs the service with a configuration, and sysmon64.exe -c sysmonconfig.xml loads a revised one. A Linux version also exists and writes to syslog, though Windows is where Sysmon is most widely deployed.
Example: a malicious macro in the logs
A user opens an invoice attachment, and moments later the SIEM receives this Sysmon event from the workstation:
Event ID 1: Process Create
ParentImage: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: powershell.exe -nop -w hidden -enc SQBFAFgA...
User: CORP\tmorgan
Word has no reason to start a hidden PowerShell window with an encoded command. A few seconds later, event 3 shows the same PowerShell process connecting to an unfamiliar address on port 443, and event 11 shows a new executable written to the user's AppData folder. Three events link the attachment, the script, the outbound connection and the dropped payload, and the hashes in event 1 can be checked against threat intelligence.
Sysmon vs. Windows Security logs and EDR
- Windows Security log: event 4688 also records process creation when auditing is enabled, and it captures the command line only if a separate policy setting is turned on. Sysmon adds file hashes, parent command lines and per-process network and DNS detail that the built-in auditing lacks or records less conveniently.
- EDR: collects similar telemetry but also analyzes it, raises alerts and can respond by killing a process or isolating the host. Sysmon is a free sensor with no alerting, analysis or incident response of its own.
- SIEM: aggregates and correlates logs from many sources. Sysmon is one of the sources a SIEM ingests, not a replacement for it.
Sysmon on the CompTIA Security+ exam
Sysmon fits SY0-801 objective 4.8, which covers the data sources that support an investigation, including endpoint logs. Expect it as an example of an endpoint log source. When a scenario asks which data would show the command line a process ran with, or which program opened a suspicious connection, endpoint logs such as Sysmon are the answer, not firewall logs or NetFlow, which see traffic but not the process behind it. Don't mistake it for an EDR product: Sysmon records activity but doesn't analyze it, alert on it or respond to it. Its logs also help only if they leave the host, so forwarding to a SIEM is part of any sensible deployment.