Sysmon
Windows Sysinternals service that logs detailed process, network, and file activity to the event log.
Technical Architecture & Overview
Sysmon is a Windows system service and driver that records process creation with command lines, image and file hashes, network connections, driver loading, and other telemetry into the Windows event log. Configuration files select which events to capture. Windows 11 versions 24H2 and 25H2 now include a built-in Sysmon that is disabled by default, and any standalone Sysmon installation must be removed before it can be enabled.
Targeted Technical Use Cases
Feeding SIEMs with high-value Windows endpoint telemetry beyond default event logging.
Evaluation & Trade-offs
Core Strengths
- +Events land in the Windows event log for collection by Windows Event Collection or SIEM agents.
- +Configuration-driven event selection.
- +Optional events cover DNS queries, named pipes, WMI, and process tampering.
Trade-Offs & Limitations
- -Event volume needs storage planning.
- -Built-in Sysmon on recent Windows 11 builds cannot run alongside the standalone download.
Defensive Security Application
Collecting endpoint events that make process injection and other intruder and malware activity visible.
Frequently Asked Questions
What is Sysmon?→
Sysmon is a Windows system service and driver that records process creation with command lines, image and file hashes, network connections, driver loading, and other telemetry into the Windows event log. Configuration files select which events to capture. Windows 11 versions 24H2 and 25H2 now include a built-in Sysmon that is disabled by default, and any standalone Sysmon installation must be removed before it can be enabled.
What is Sysmon used for?→
Feeding SIEMs with high-value Windows endpoint telemetry beyond default event logging.
What are the strengths of Sysmon?→
- +Events land in the Windows event log for collection by Windows Event Collection or SIEM agents.
- +Configuration-driven event selection.
- +Optional events cover DNS queries, named pipes, WMI, and process tampering.
What are the limitations of Sysmon?→
- +Event volume needs storage planning.
- +Built-in Sysmon on recent Windows 11 builds cannot run alongside the standalone download.
How is Sysmon used defensively?→
Collecting endpoint events that make process injection and other intruder and malware activity visible.