# Sysmon

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/sysmon

## Quick definition

Sysmon is a tool from Microsoft that watches what programs and processes do on a computer and writes that information in a log. It keeps track of things like which programs start, which files they open, and which network connections they make. Security professionals use these logs to find suspicious activity, like malware trying to hide. It is part of the Windows Sysinternals suite.

## Simple meaning

Imagine you have a security camera inside your computer that records every single move every program makes. Sysmon is exactly that kind of camera but for the Windows operating system. It does not stop bad things from happening, but it takes detailed notes about everything that runs, every file that is created or changed, every network connection that is made, and even when programs try to change system settings. Think of it like a logbook in a library. The librarian does not prevent someone from tearing a page, but they record who entered, what books they touched, and when they left. Later, if a book is damaged, the librarian can look back at the log to find the culprit. In the same way, when a computer gets infected with malware, investigators use Sysmon logs to track exactly what the malware did, where it came from, and what files it touched. Sysmon runs quietly in the background and never interferes with your work. It is not an antivirus, it is a surveillance tool. The logs it creates are very detailed and can be sent to a central security system where analysts watch for patterns that indicate an attack. For IT professionals, understanding Sysmon is like a detective understanding how to gather evidence. Without good logs, finding the cause of a security breach is almost impossible. With Sysmon, you have a step-by-step record of the attack, which helps you stop it and prevent it from happening again.

## Technical definition

Sysmon, formally known as System Monitor, is a kernel-mode driver and user-mode service developed by Microsoft as part of the Sysinternals suite. It installs as a Windows service and a device driver that hooks into various system callbacks to capture and log system activity to the Windows Event Log under the 'Microsoft-Windows-Sysmon/Operational' channel. Sysmon can log process creation (including command lines and hashes using Process Hacker or MD5, SHA1, SHA256), network connections (source and destination IPs, ports, protocols), file creation time changes (to detect timestomping), process access (to detect privilege escalation attempts like Mimikatz), image loading (for malicious DLL injection), and registry event changes. It can also filter events based on include and exclude rules defined in an XML configuration file, enabling high-fidelity detection of known malicious behaviors while reducing noise. Sysmon does not use signatures like antivirus, so it can detect novel or fileless malware. It relies on the Windows ETW (Event Tracing for Windows) and kernel callbacks. The logs can be collected by SIEM systems like Splunk, Elastic Stack, or Azure Sentinel. IT professionals often deploy Sysmon via Group Policy or configuration management tools. The XML configuration can be customized to, for example, only log execution of binaries from specific paths or only log network connections to suspicious ports. Sysmon integrates with Windows Event Forwarding (WEF) for centralized log collection. It supports Windows 7 and later, including Windows Server editions. Installation is done via command line with options like '-accepteula -i' and uninstallation with '-u'. The configuration is applied with '-c config.xml'. Sysmon does not generate alerts itself, but security information and event management (SIEM) tools can create alerts based on Sysmon event IDs, such as Event ID 1 (Process Create), Event ID 3 (Network Connect), Event ID 7 (Image Loaded), Event ID 11 (File Create), and Event ID 13 (Registry Value Set).

## Real-life example

Think of Sysmon like a detailed diary you keep for your house. You do not have cameras everywhere, but you write down every time someone enters or leaves, what room they went into, and what they touched. If a guest comes over and later you notice a vase is missing, you can look in your diary. You see that your guest went into the living room and picked up the vase. You know exactly who took it. Sysmon does the same for your computer. For example, your coworker downloads a free game from a website you do not trust. Later, your computer starts acting slow and sending strange emails. Without Sysmon, you might guess that the game caused the problem, but you would not know for sure. With Sysmon, you can look at the log and see that when the game was installed, it also ran a hidden program that connected to a known bad IP address in Russia and created a new file in the Windows system folder. You have clear evidence that the game was the entry point. It is like having a detailed timeline of the crime. Sysmon does not stop the intruder, but it gives you the evidence you need to catch them and fix the damage. In real IT environments, analysts use Sysmon logs to investigate ransomware attacks, data breaches, and insider threats. Without Sysmon, these investigations are like trying to solve a mystery with no clues. With Sysmon, you have a complete record of the attack, which makes your job much easier and more effective.

## Why it matters

Sysmon matters because it gives security teams the visibility they need to detect and investigate attacks that other security tools might miss. Traditional antivirus relies on signatures, so if malware is new or modified, it can pass through undetected. Sysmon does not rely on signatures, so it can log the behavior of any program, even unknown ones. That means if a piece of malware tries to run a PowerShell script that connects to a command-and-control server, Sysmon will log both the process creation and the network connection. An analyst can then see the suspicious activity even though the malware itself was not flagged by antivirus. Sysmon also helps with incident response. When a breach happens, the first question is always, what did the attacker do? Without Sysmon, you have to dig through many different logs or hope that the antivirus caught something. With Sysmon, you have a single, clean, chronological log of everything the attacker did from the moment they gained access. This saves hours of investigation time. Sysmon is free and lightweight. It runs on all modern Windows systems and does not slow down the computer. For IT professionals, deploying Sysmon is a best practice recommended by the US National Security Agency and the Cybersecurity and Infrastructure Security Agency. It is a foundational tool for any organization that wants to improve its security posture. Without Sysmon, organizations are flying blind. With it, they have a powerful lens into the activity on their endpoints.

## Why it matters in exams

Sysmon appears in security certification exams such as CompTIA Security+, CompTIA CySA+, CompTIA CASP+, and the Microsoft Security Operations Analyst (SC-200) exam. In Security+, Sysmon is relevant to the 'Security Operations' domain, especially for understanding logging and monitoring concepts. Questions may ask how Sysmon differs from a standard event log or why it is useful for detecting malware. In CySA+, Sysmon is frequently tested in the context of threat detection and response. You may be asked to interpret Sysmon logs to identify a specific type of attack, such as a DLL injection or a timestomping attack. For CASP+, Sysmon might appear in questions about advanced endpoint monitoring and configuration management for enterprise environments. In the SC-200 exam, Sysmon is directly relevant to Microsoft Defender for Endpoint and Azure Sentinel integration. Questions often ask how to configure Sysmon to forward logs to a SIEM or how to create custom analytics rules based on Sysmon events. In exam questions, Sysmon is often compared to Windows Event Log and Windows Defender. Test takers must know that Sysmon provides deeper visibility, especially for process creation with full command lines, network connections, and file hash logging. Another common exam scenario is a question about detecting malicious PowerShell usage. Sysmon logs the full command line of PowerShell, so an analyst can see if it was used to download or execute malware. You should also know that Sysmon logs are stored in the Event Viewer under 'Applications and Services Logs' and that each event type has a specific ID. For example, Event ID 1 is process creation, 3 is network connection, 7 is image load, and 11 is file create. Exam questions sometimes ask which Sysmon event ID would be used to detect a specific behavior. Mastery of these event IDs is critical for exam success.

## How it appears in exam questions

Sysmon questions in exams often present a scenario where a security incident has occurred, and the candidate must analyze a Sysmon log excerpt to determine what happened. For example, a question might show a list of Sysmon events and ask the student to identify the sequence of actions a malware sample took. The events could include a process creation (Event ID 1) showing 'powershell.exe -enc Base64EncodedCommand', followed by a network connection (Event ID 3) to an external IP on port 443, and a file creation (Event ID 11) in the Startup folder. The candidate would need to recognize this as a typical PowerShell download cradle and persistence mechanism. Another common question type is configuration-based. The question might describe an organization that needs to monitor only specific processes for security reasons and ask which Sysmon configuration method should be used. The answer would be an XML configuration file that includes only the process names of interest, reducing log noise. Troubleshooting questions also appear: for example, a company has deployed Sysmon but notices that process creation logs are missing. The candidate must check if the Sysmon service is running and if the configuration has an include filter that accidentally excludes those processes. Some questions compare Sysmon with other tools. A scenario might describe an analyst who needs to detect file timestomping, and the candidate must know that Sysmon Event ID 2 (File Creation Time Changed) is the correct event to check. In advanced exams like CySA+, questions may ask for the best way to investigate a suspicious DLL loaded into a legitimate process. The answer would be to look at Sysmon Event ID 7 (Image Loaded) to see what DLL was loaded and from which path. Understanding these patterns will help you answer Sysmon questions correctly.

## Example scenario

You are a security analyst for a small company. One morning, users complain that their files are being renamed with a '.locked' extension. You suspect ransomware. You check the Sysmon logs on a affected computer. You see a series of events. First, Event ID 1 shows that a process named 'explorer.exe' spawned a child process called 'update.exe' from the Downloads folder. The command line shows that 'update.exe' ran with the argument '-silent'. Next, Event ID 3 shows that 'update.exe' made a network connection to an IP address in a foreign country on port 443. Then, Event ID 11 shows that 'update.exe' created a file named 'encrypt.exe' in the AppData folder. Finally, Event ID 1 shows that 'encrypt.exe' started running and began accessing many files on the network share. From this log, you can identify the initial infection point was the 'update.exe' file downloaded by the user. You also know that the ransomware connected to a command-and-control server before encrypting files. You can block the malicious IP address at the firewall, remove the 'update.exe' and 'encrypt.exe' files, and restore the encrypted files from backup. Without Sysmon, you would only know that files were encrypted, but you would not know how the ransomware got in or what it did. This scenario shows how Sysmon provides the critical evidence needed to respond effectively to an attack.

## Common mistakes

- **Mistake:** Thinking Sysmon is an antivirus that blocks malware.
  - Why it is wrong: Sysmon is a monitoring tool, not a prevention tool. It only logs activity, it does not stop malicious processes from running.
  - Fix: Understand that Sysmon provides visibility, not protection. Use it alongside antivirus and endpoint detection tools.
- **Mistake:** Confusing Sysmon event IDs with standard Windows Event IDs.
  - Why it is wrong: Sysmon has its own specific event IDs (1, 3, 7, 11, etc.) that are different from Windows Event IDs. Using the wrong ID in a query will return no results.
  - Fix: Memorize the common Sysmon event IDs: 1 for process creation, 3 for network connection, 7 for image load, 11 for file creation, and 13 for registry modification.
- **Mistake:** Believing Sysmon captures all activity by default without configuration.
  - Why it is wrong: By default, Sysmon logs many events, but you often need an XML configuration file to filter or capture specific behaviors. Without configuration, you may miss important events or be overwhelmed by noise.
  - Fix: Always deploy Sysmon with a carefully tuned XML configuration file that matches your security monitoring goals.
- **Mistake:** Assuming Sysmon logs are tamper-proof.
  - Why it is wrong: Sysmon logs are stored in the Windows Event Log, which can be cleared or modified by an attacker with administrator privileges. Sysmon does not protect its own logs.
  - Fix: Forward Sysmon logs to a centralized, write-once SIEM system to prevent tampering.
- **Mistake:** Thinking Sysmon only works on Windows Server editions.
  - Why it is wrong: Sysmon works on Windows 7 and later, including client editions like Windows 10 and 11, as well as Windows Server.
  - Fix: Deploy Sysmon on all Windows endpoints, not just servers, to get full visibility.

## Exam trap

{"trap":"In a question about detecting a suspicious DLL injection, the answer options include Sysmon Event ID 1, 3, 7, and 11. Many learners choose Event ID 1 (process creation) because they think the attack starts with a process. However, the correct answer is Event ID 7 (image load) because DLL injection involves loading a malicious DLL into a running process, which is captured by the image load event.","why_learners_choose_it":"Learners often associate attacks with process creation because that is the first event they usually study. They may not realize that the attack vector is a DLL being loaded into an existing legitimate process, which is a different event.","how_to_avoid_it":"When you see 'DLL injection' or 'DLL sideloading' in a question, immediately think of Sysmon Event ID 7. Practice mapping attack techniques to the correct Sysmon event IDs by studying the MITRE ATT&CK framework mapping to Sysmon events."}

## Commonly confused with

- **Sysmon vs Windows Event Log:** Windows Event Log is the native logging system in Windows that records system, application, and security events. Sysmon adds additional, more detailed logs to the Windows Event Log, specifically for security operations. While the standard Event Log might show that a process started, Sysmon shows the full command line, process hash, and parent process. (Example: The Windows Event Log might record that 'powershell.exe' started. Sysmon would record that 'powershell.exe' started with the command line 'powershell -enc XYZ', including the encoded script, and that its parent process was 'explorer.exe'.)
- **Sysmon vs Windows Defender (Microsoft Defender Antivirus):** Windows Defender is an antivirus that uses signatures and behavior analysis to block malware. Sysmon is a monitoring tool that logs activity but does not block anything. Defender prevents attacks, Sysmon provides evidence after the fact. They are complementary, not the same. (Example: If a new, unknown piece of malware runs, Windows Defender might not block it because it has no signature. But Sysmon will still log the process creation, network connection, and file changes, allowing an analyst to detect the malware manually.)
- **Sysmon vs Process Monitor (Procmon):** Process Monitor is a real-time troubleshooting tool that shows live system activity including registry, file system, and process operations. Sysmon logs activity persistently to the Event Log for later analysis, while Procmon is a live debugging tool not designed for continuous security monitoring. (Example: If a user runs a suspicious program, a security analyst would use Sysmon to look at logs collected over the past week. A troubleshooting technician would use Process Monitor to watch the program's activity live on the machine.)

## Step-by-step breakdown

1. **Download and Install Sysmon** — Download Sysmon from the Microsoft Sysinternals website. Run the installer as Administrator with the command 'Sysmon64.exe -accepteula -i'. This installs the driver and service, and starts logging with a default configuration that captures many events.
2. **Apply a Custom Configuration (Optional but Recommended)** — Use a configuration XML file to include or exclude specific events. Run 'Sysmon64.exe -c config.xml' to load the configuration. This reduces noise and focuses on relevant security events, such as only logging process creation for known suspicious executables.
3. **Verify Installation and Logging** — Open Event Viewer and navigate to 'Applications and Services Logs' then 'Microsoft' then 'Windows' then 'Sysmon' then 'Operational'. You should see events populating. Perform a test action like starting Notepad and verify an Event ID 1 appears with the process name and command line.
4. **Forward Logs to a SIEM System** — To centralize monitoring, configure Windows Event Forwarding (WEF) or use an agent to send Sysmon logs to a SIEM like Splunk, Elastic, or Azure Sentinel. This allows security analysts to aggregate and analyze logs from all endpoints in one place.
5. **Create Detection Rules in the SIEM** — Write SIEM queries that look for specific Sysmon event IDs and attributes. For example, a rule might alert on Event ID 1 where the command line contains 'Invoke-Mimikatz' or 'powershell -enc'. These rules turn raw logs into actionable security alerts.
6. **Review Logs Regularly and Investigate Alerts** — Security analysts review Sysmon logs daily, looking for anomalies. When an alert fires, the analyst examines the full event timeline to understand the attack chain and take appropriate response actions.

## Practical mini-lesson

Sysmon is a powerful tool, but its value depends entirely on how you use it. As an IT professional, you must understand not only how to install it but how to configure it for your specific environment. The default configuration logs many events, which can generate gigabytes of logs per day. Without proper filtering, you will drown in data and miss real threats. Therefore, the first practical step after installation is to create a tailored XML configuration file. This file uses include and exclude filters. For example, you might exclude all processes from 'C:\Windows\System32' because they are typically benign, but include any process running from 'C:\Users\' or 'C:\Temp\', which are common locations for malware. You can also filter by process name, command line, or parent process. Another critical configuration is enabling command-line logging for all processes, because attackers often use PowerShell with encoded commands. Without this, you lose the most valuable data. Professional deployments also use Sysmon to detect 'living off the land' binaries (LOLBins) like certutil.exe or mshta.exe when they are used for malicious purposes. By monitoring the command-line arguments of these utilities, you can spot abuse. Common mistakes in configuration include over-excluding, which could blind you to attacks using legitimate system tools, and under-excluding, which leads to log overload. A recommended approach is to start with a well-known community configuration from resources like the SwiftOnSecurity Sysmon config, then customize it. You should also ensure that Sysmon logs are forwarded in real-time, because if an attacker gains admin rights, they can clear local logs. Practically, set up a test lab with a couple of Windows VMs, install Sysmon, and simulate a simple attack like downloading and running Mimikatz. Then examine the Sysmon logs to see exactly what events were generated. This hands-on practice will solidify your understanding far more than reading theory. Finally, remember that Sysmon is not a set-and-forget tool. As new attack techniques emerge, you must update your configuration and detection rules. Joining the security community and staying updated on new Sysmon capabilities is part of the job.

## Commands

```
Sysmon64.exe -accepteula -i
```


```
Sysmon64.exe -c myconfig.xml
```


```
Sysmon64.exe -u
```


```
Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | Where-Object {$_.Id -eq 1}
```


## Troubleshooting clues

- **undefined** — symptom: undefined. Check if the Sysmon service is running using 'services.msc' or 'Get-Service Sysmon'. If the service is stopped, start it. Also verify the Sysmon driver is installed with 'fltmc' or 'driverquery'.
- **undefined** — symptom: undefined. By default, Sysmon does not log all network connections. Check if your configuration file has an include rule for network connections or if it is filtered out. Use a configuration that explicitly enables network logging.
- **undefined** — symptom: undefined. This is rare but can happen if there is a conflict with other kernel drivers, especially security software. Ensure you have the latest version of Sysmon from Microsoft. Try booting in Safe Mode and uninstalling Sysmon, then reinstall the latest version.

## Memory tip

Remember Sysmon event IDs with the phrase '1 Process, 3 Network, 7 Image, 11 File, 13 Registry', memorize these five and you can answer most exam questions.

## FAQ

**Is Sysmon free to use?**

Yes, Sysmon is completely free and is included in the Microsoft Sysinternals suite, which is freely downloadable from the Microsoft website.

**Can Sysmon detect all types of malware?**

No, Sysmon is a monitoring tool, not a detection tool. It logs activity, but it does not have built-in detection signatures. However, when combined with a SIEM and analytics rules, it can help detect malicious behavior.

**Does Sysmon work on Windows 11?**

Yes, Sysmon works on Windows 11, Windows 10, Windows 8.1, Windows 7, and corresponding Windows Server editions.

**How do I update Sysmon?**

Download the latest version from the Microsoft Sysinternals website, then run the installation command again. Your existing configuration file can be reapplied after the update.

**Can Sysmon logs be tampered with by an attacker?**

Yes, if an attacker gains administrator privileges, they can stop the Sysmon service or clear the Event Log. To prevent this, forward logs to a centralized, immutable SIEM.

**What is the difference between Sysmon and Windows Event Log Security log?**

The Security log in Event Viewer records standard audit events like logon attempts. Sysmon logs much more detailed information, including full command lines, process hashes, and DLL load events, which are not available in the standard Security log.

## Summary

Sysmon is an essential tool for any IT professional working in security operations. It provides deep visibility into Windows system activity by logging process creations, network connections, file changes, and more. Unlike traditional antivirus, Sysmon does not rely on signatures, making it effective for detecting novel and fileless attacks. For certification exams, you must know the common Sysmon event IDs (1, 3, 7, 11, 13), understand how to use XML configuration files to filter logs, and be able to interpret Sysmon logs in incident response scenarios. In the real world, Sysmon is a foundational component of endpoint monitoring and is recommended by leading cybersecurity agencies. Deploying it correctly requires careful configuration to balance visibility with log volume. When integrated with a SIEM, Sysmon empowers security teams to detect, investigate, and respond to threats effectively. Whether you are studying for CompTIA Security+, CySA+, or Microsoft SC-200, mastering Sysmon will give you a significant advantage both on the exam and in your career as an IT security professional.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/sysmon