System Monitor (Sysmon) is a Windows System Service and Device Driver that will monitor and log the system activity to Windows Event log once it’s installed.
Sysmon is a part of the Sysinternals tools. Sysinternals is a set of Windows utility programs first released in 1996, long before Russinovich joined Microsoft. Almost all were written by Russinovich and his then-partner Bryce Cogswell. Sysmon, written by Russinovich and Thomas Garnier, also of Microsoft, is the 73rd tool in the
System Monitor (Sysmon) provides the detail information about the Process, Network Connection and Changes to file creation time By collecting the events it generates using Windows Event Collection or SIEM agents.
Sysmon Capabilities
Sysmon includes the following capabilities:
- Logs process creation with full command line for both current and parent processes.
- Records the hash of process image files using SHA1 (the default), MD5, SHA256 or IMPHASH.
- Multiple hashes can be used at the same time.
- Includes a process GUID in process create events to allow for correlation of events even when Windows reuses process IDs.
- Include a session GUID in each events to allow correlation of events on same logon session.
- Logs loading of drivers or DLLs with their signatures and hashes.
- Logs opens for raw read access of disks and volumes
- Optionally logs network connections, including each connection’s source process, IP addresses, port numbers, hostnames and port names.
- Detects changes in file creation time to understand when a file was really created. Modification of file create timestamps is a technique commonly used by malware to cover its tracks.
- Automatically reload configuration if changed in the registry.
- Rule filtering to include or exclude certain events dynamically.
- Generates events from early in the boot process to capture activity made by even sophisticated kernel-mode malware.
Sysmon Event
Below is the example of each Event type that Sysmon Generates.
- Event ID 1: Process creation
- Event ID 2: A process changed a file creation time
- Event ID 3: Network connection
- Event ID 4: Sysmon service state changed
- Event ID 5: Process terminated
- Event ID 6: Driver loaded
- Event ID 7: Image loaded
- Event ID 8: CreateRemoteThread
- Event ID 9: RawAccessRead
- Event ID 10: ProcessAccess
- Event ID 11: FileCreate
- Event ID 12: RegistryEvent (Object create and delete)
Sysmon Parameter
| Parameter | Description |
|---|---|
| -c | Update configuration of an installed Sysmon driver or dump the current configuration if no other argument is provided. Optionally take a configuration file. |
| -d | Specify the name of the installed device driver image. Configuration entry: DriverName. The service image and service name will be the same. |
| -h | Specify the hash algorithms used for image identification (default is SHA1). It supports multiple algorithms at the same time. Configuration entry: HashAlgorithms. |
| -i | Install service and driver. Optionally take a configuration file. |
| -l | Log loading of modules. Optionally take a list of processes to track. |
| -m | Install the event manifest (done on service install as well). |
| -n | Log network connections. Optionally take a list of processes to track. |
| -r | Check for signature certificate revocation. Configuration entry: CheckRevocation. |
| -s | Print configuration schema definition. |
| -u | Uninstall service and driver. |
You can find out the detail about Sysmon by follow this link https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 v9 is now available. System Monitor is a Windows System Service and Device Driver that will monitor and log the system activity){kind=link}