Sysmon’s service has already started logging events to its own channel and the driver will now be a boot-start driver. If you don’t wish to configure the service, this was it. For now, let’s install Sysmon with the defaults (from an administrative console): Sysmon64.exe -i We’ll get back to configuring the service later. Though there’s a default setting in place, you can also pass your own configuration file to over-ride the default settings. So, the installation of Sysmon as a service/driver required a configuration file. First, let’s take a look at the options provided by the binary: Sysmon64.exe -h After acquiring the binaries from Microsoft’s own website - head towards the console in the same directory. Installing and configuring Sysmon is fairly easy. Kernel-mode malware, rule filtering based on False Positives, session identification, correlations, and much more!.File modification - Identify changes in file creation times, a technique most commonly utilized by attackers to avoid detection.DLL loading - identify the loading of DLLs along with their hashes.Hashing process images - a hash of process image files is available in SHA1, MD5, SHA-256, or the IMPHASH format.Network communications - connection’s source processes, IPs, ports, hostnames, etc.Log process creation - command line, basic process information, parent process information, etc.However, you can get a quick idea on how Sysmon can aid you in identifying anomalous activities by checking this short list of features: What Does Sysmon Do?ĭue to active development of the project, newer artifacts and evidence sources are constantly being added to Sysmon’s capabilities. Just a quick analysis of the logs generated by Sysmon can help identify malware, intrusions, and breaches within the network. The utility is registered in a Windows box as a system service and a device driver, which in sync, help log activities across the environment to the Windows Event log. Sysmon, short for System Monitor, is a utility tool developed by Mark Russinovich, as part of the Sysinternals suite.

System monitor sysinternals