Sysmon (System Monitor) is a free Sysinternals tool that logs rich, high-fidelity endpoint telemetry to the Windows event log - the raw material most Windows detections are built on.
The events that matter
- Event ID 1 - Process creation - the crown jewel: full command line, parent process, hashes, and signing info. Most behavioral detections start here.
- Event ID 3 - Network connection - which process talked to where (catch LOLBins beaconing).
- Event ID 7 - Image loaded - DLLs loaded (DLL hijacking, unsigned modules).
- Event ID 8 - CreateRemoteThread - classic code injection.
- Event ID 11 - File create - dropped payloads, new web-root files.
- Event ID 12/13/14 - Registry - Run keys and persistence.
- Event ID 22 - DNS query - per-process DNS (tunneling, C2 domains).
The config is everything
Raw Sysmon is noisy. A tuned configuration (a well-known baseline like SwiftOnSecurity's, or the modular Olaf Hartong config) filters the noise and keeps the signal. Version-control your config and roll changes deliberately.
Deploy well
- Push Sysmon + config via GPO/your management tool to every Windows host.
- Forward the logs off-box (WEF or an agent) to your SIEM - local logs get cleared by attackers.
- Map your Sysmon-based detections to ATT&CK and measure coverage.
Sysmon + a good config + log forwarding is the highest-ROI upgrade most Windows shops can make.