Sysmon Event Log

What it is

System Monitor (Sysmon) is a free Sysinternals tool made of a service (Sysmon.exe or Sysmon64.exe) and a kernel minifilter driver (SysmonDrv, altitude 385201). It writes detailed telemetry about processes, network connections, file and registry activity into its own event log channel. It is not installed by default: finding it on a host means someone deployed it, usually the security team. Recent Windows 11 and Server 2025 builds also ship Sysmon as an optional Windows feature, but it still has to be enabled and configured.

What gets logged depends entirely on the XML configuration loaded at install time (sysmon -accepteula -i config.xml) or later (sysmon -c config.xml). Community baselines such as SwiftOnSecurity's or Olaf Hartong's sysmon-modular are common.

Location

Current Sysmon releases target Windows 10/11 and Server 2012 R2 or later; older releases ran on Windows 7. Check the version you find (Sysmon.exe file version or sysmon -c output).

What it proves

• Execution with context: image path, full command line, parent process, user, integrity level and file hashes (event 1). This is some of the richest evidence of execution you can get.
• Network activity per process: source and destination IP and port, plus hostname when resolved (event 3), and DNS queries per process (event 22).
• Persistence and defence evasion: registry run keys (12–14), dropped files (11), driver loads (6), process injection (8, 10, 25).

It does not prove anything the config excluded. An absent event means "not logged", not "did not happen". Check the loaded config before drawing negative conclusions.

Key fields

ProcessGuid is unique per process instance, unlike PIDs which are reused. Pivot on it to tie events 1, 3, 7, 11, 22 and 5 into one process story.

Timestamps

Retention and clearing

• The Operational channel is circular; its default maximum is commonly 64 MB. With process, image-load or network logging enabled, busy hosts can wrap in hours. Check wevtutil gl Microsoft-Windows-Sysmon/Operational.
• Clearing this channel is recorded as event 104 in the System log, not as Security 1102.
• Tampering signs: event 4 with State: Stopped, event 16 (new config, compare ConfigurationFileHash), event 255 errors, a gap in otherwise steady event flow, fltMC.exe unload SysmonDrv in process telemetry, or service changes in the System log (7036, 7040). Uninstall (sysmon -u) removes the driver and service but the .evtx normally survives.

Collection

The EventLogs KAPE and Velociraptor targets include this channel. Export and record the active config:

wevtutil epl Microsoft-Windows-Sysmon/Operational E:\case\Sysmon.evtx
wevtutil gl Microsoft-Windows-Sysmon/Operational
Sysmon64.exe -c
reg export HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters E:\case\SysmonDrv.reg

Get-WinEvent -Path E:\case\Sysmon.evtx -FilterXPath "*[System[EventID=1]]" |
  Select-Object TimeCreated, @{n='Cmd';e={$_.Properties[10].Value}}

Parsing tools

• EvtxECmd (Eric Zimmerman): Sysmon maps flatten EventData into CSV columns for Timeline Explorer.
• Chainsaw and Hayabusa: Sigma-based hunting, most rules are written for Sysmon fields.
• Get-WinEvent: quick XPath filtering on live hosts or exported files.
• Velociraptor: EVTX hunting artifacts across a fleet.

Investigation tips

• Start with event 1 filtered on unusual parents (w3wp.exe, winword.exe, wmiprvse.exe) and LOLBins, then pivot on ProcessGuid.
• Use Hashes to match binaries against threat intel or Amcache SHA-1 values, even after the file is deleted.
• LogonId in event 1 links processes to a Security 4624 logon session.
• Event 10 against lsass.exe with suspicious GrantedAccess values (for example 0x1010, 0x1410) is a classic credential dumping lead; confirm with the call trace.
• Before relying on it, read the config: many baselines exclude noisy but relevant paths.