Sysmon (Sysinternals)

What it is

Sysmon, short for System Monitor, is a Windows system service and device driver from Microsoft's Sysinternals suite. Once installed, it stays resident across reboots and writes detailed events to the Windows event log covering process creation with full command lines, network connections tied to the process that made them, file creation time changes, driver and DLL loads with hashes, registry changes, named pipe activity and more, numbered as distinct event IDs from 1 upward.

Why it matters for detection

Standard Windows event logging is comparatively sparse. Sysmon fills that gap with the kind of detail defenders actually need, for example a full process command line rather than just a process name, or the specific hash of an executable that ran. This is exactly why so much publicly shared detection content, including many SigmaHQ rules, is written directly against specific Sysmon event IDs rather than generic Windows events.

How to use it

Download it free from Microsoft's Sysinternals site, install it with a configuration file that defines which events to include or exclude (unfiltered Sysmon on a busy machine generates a large volume of events), and forward its logs to a central location such as Windows Event Collection or a SIEM like Wazuh for analysis. Community-maintained configuration files exist as a starting point, though tuning one to your own environment is normal.

Free versus paid

Sysmon is completely free, distributed directly by Microsoft with no licence fee. There is no paid tier or feature restriction.

Prerequisites

Comfort administering Windows, including its Event Viewer and basic registry and service concepts, is enough to install and configure it. Understanding a config file's include and exclude filtering logic takes a little practice, since overly broad configuration can generate overwhelming log volume.

Limitations

Sysmon logs activity; it does not analyse or alert on it by itself, and it makes no attempt to hide itself from a sufficiently privileged attacker who could in principle tamper with or disable it. It needs to be paired with a log collection and analysis layer, such as a SIEM, to be useful for detection rather than just producing logs nobody reads.

Common questions

Does Sysmon slow down a machine noticeably? With a reasonably tuned configuration, overhead is generally low; poorly tuned configurations that log everything, especially image loads, can generate significant volume and some performance impact.

Is there a Linux equivalent? Yes, SysmonForLinux is a separate, actively maintained open source port that logs similar event types on Linux.

Do I need a SIEM to benefit from installing it? Not strictly, since you can read events directly in Event Viewer for learning, but a SIEM is what makes Sysmon data useful at scale.