Sysmon, short for System Monitor, is a free Sysinternals tool that runs as a Windows service and driver and records detailed system activity to the Windows event log. It adds process creation with command lines, hashes, network connections and registry changes. It does not analyze events, so you need something to read them.
What it is
Microsoft describes Sysmon as remaining resident across reboots to monitor and log system activity. Its docs say it does not analyze the events it generates and does not try to hide from attackers. A Linux version exists as a separate project.
The events that matter most
Sysmon assigns each event type an ID. A selection:
- 1, Process creation: full command line for the new process and its parent, plus hashes and a process GUID for correlation.
- 3, Network connection: TCP and UDP connections tied to a process. Disabled by default.
- 7, Image loaded: modules loaded into a process. Disabled by default and noisy if unfiltered.
- 8, CreateRemoteThread: a process creating a thread in another process, a technique used for code injection.
- 10, Process access: one process opening another. The docs say this lets you detect tools that read LSASS memory to steal credentials.
- 11, File create: useful for startup folders and download directories.
- 12, 13, 14, Registry events: key and value creation, deletion, setting and renaming.
- 22, DNS query: the process that made a lookup.
- 25, Process tampering: detection of process hiding such as hollowing.
The list goes up to ID 29, with ID 255 for errors.
Why command lines and hashes help
The default Windows log tells you a process started. Sysmon adds the exact command line and the parent process. That turns "powershell ran" into "powershell ran with this encoded argument, launched by this document reader." Hashes let you compare against known files, and the process GUID lets you follow a chain of events even when process IDs are reused.
Where the logs go
On Vista and later they land in Applications and Services Logs, under Microsoft, Windows, Sysmon, Operational. Collect them with Windows Event Collection or a SIEM agent. Timestamps are in UTC.
Costs and cautions
Volume is the main issue. Microsoft warns that logging all image loads produces a significant amount of data, and that process access should be filtered to remove expected accesses. Also plan who maintains the configuration and how changes are reviewed.
What it does not do
It is not antivirus and not EDR. It does not respond to threats, though newer event types can block certain file creation. It does not tell you an event is malicious. Think of it as a high quality sensor.
Quick check
Does Sysmon need a reboot to install?
According to its documentation, neither install nor uninstall requires a reboot.
Is network logging on by default?
No. The network connection event is disabled by default and needs configuration.
Sources
Last reviewed: 19 October 2026.
