Sysmon

What Sysmon Is and Why Every SOC Needs It

Sysmon is a Microsoft Sysinternals tool that installs as a Windows system service and device driver. Once installed, it logs system activity to the Windows Event Log with far more detail than the built-in Security log provides.

• Sysmon Event ID 1 (process creation) includes the SHA1, SHA256, and MD5 hash of every executable that runs — enabling immediate file reputation lookup without a separate EDR agent.
• Sysmon Event ID 3 (network connection) maps outbound connections to the specific process that made them — you see not just “connection on port 443” but “powershell.exe connected to 192.168.1.100:8443”.
• Sysmon Event ID 22 (DNS query) logs every DNS query per-process — critical for detecting DGAs, DNS tunneling, and C2 domains.
• Sysmon does all of this without a reboot, without replacing Windows core components, and at minimal performance cost.

MITRE ATT&CK maps log enumeration to T1654. Sysmon does the enumerating — turning Windows endpoint activity into structured, searchable events.

Installation and Configuration

Installation

# Download Sysmon from Microsoft Sysinternals
curl -o C:\Tools\Sysmon.zip https://download.sysinternals.com/files/Sysmon.zip
expand C:\Tools\Sysmon.zip -F:* C:\Tools\Sysmon

# Install Sysmon with a configuration file
Sysmon64.exe -accepteula -i C:\Configs\sysmon-config.xml

# Check installed version and status
Sysmon64.exe -s

# Update Sysmon without rebooting
Sysmon64.exe -accepteula -u  (uninstall current)
Sysmon64.exe -accepteula -i C:\Configs\sysmon-config.xml  (reinstall with updated config)

Recommended Configuration File Sources

What a Good Sysmon Config Does

A well-tuned Sysmon configuration should:

1. Enable all high-value Event IDs: 1 (ProcessCreate), 3 (NetworkConnect), 7 (ImageLoad), 8 (CreateRemoteThread), 10 (ProcessAccess), 11 (FileCreate), 15 (FileCreateStreamHash), 22 (DNSEvent)
2. Exclude known-good noise: svchost.exe network connections to Windows Update, SearchIndexer.exe file accesses, MsMpEng.exe (Defender) scanning activity
3. Include known-bad patterns as includes: powershell.exe command-line logging, rundll32.exe image loads, wmic.exe command-line logging

Configuration Syntax

Sysmon configs are XML files with rules per Event ID:

<Sysmon>
  <EventFiltering>
    <!-- Include all process creation events -->
    <ProcessCreate onmatch="include">
      <!-- No child rules = capture everything -->
    </ProcessCreate>

    <!-- Exclude known-good network connections -->
    <NetworkConnect onmatch="exclude">
      <DestinationIp condition="is">10.0.0.1</DestinationIp>  <!-- Internal monitoring -->
      <Image condition="is">C:\Windows\System32\svchost.exe</Image>
    </NetworkConnect>

    <!-- Only capture specific DLL loads -->
    <ImageLoad onmatch="include">
      <Image condition="contains any">rundll32.exe</Image>
      <Image condition="contains any">regsvr32.exe</Image>
    </ImageLoad>

    <!-- Include all file creation events but exclude known-good paths -->
    <FileCreate onmatch="exclude">
      <TargetFilename condition="begin with">C:\Windows\Temp\</TargetFilename>
    </FileCreate>
  </EventFiltering>
</Sysmon>

Event ID Reference — The Full 1-29 Map

Top Detection Queries Using Sysmon

Event 1 — Process Creation with Hashes

SPL query — find processes with high-entropy command lines (likely encoded/encrypted):

index=windows sourcetype=WinEventLog:Sysmon EventCode=1
| eval cmd_len = len(CommandLine)
| where cmd_len > 500
| eval alert = "HIGH — Long command line (" . cmd_len . " chars): " . CommandLine
| table _time, Computer, Image, CommandLine, Hashes, alert
| sort - cmd_len

Event 3 — Network Connection

SPL query — find beaconing patterns (consistent outbound connections):

index=windows sourcetype=WinEventLog:Sysmon EventCode=3
| stats earliest(_time) as first, latest(_time) as last, count as total_connections by Computer, Image, DestinationIp, DestinationPort
| eval duration_hours = (last - first) / 3600
| eval connections_per_hour = total_connections / duration_hours
| where connections_per_hour > 1 AND connections_per_hour < 60
| eval interval_seconds = round(3600 / connections_per_hour, 1)
| table Computer, Image, DestinationIp, DestinationPort, total_connections, duration_hours, interval_seconds
| sort interval_seconds

Event 8 — CreateRemoteThread (Process Injection)

SPL query — detect all process injection events:

index=windows sourcetype=WinEventLog:Sysmon EventCode=8
| stats count by Computer, SourceImage, TargetImage, StartAddress
| eval alert = "CRITICAL — " . SourceImage . " injected a thread into " . TargetImage
| table Computer, SourceImage, TargetImage, count, alert
| sort - count

Event 10 — Process Access (LSASS Access)

SPL query — detect LSASS process access from non-standard processes:

index=windows sourcetype=WinEventLog:Sysmon EventCode=10
| search TargetImage="*lsass.exe"
| search SourceImage!="*svchost.exe" AND SourceImage!="*csrss.exe" AND SourceImage!="*wininit.exe"
| stats count by Computer, SourceImage, TargetImage, GrantedAccess
| eval alert = "CRITICAL — " . SourceImage . " accessed lsass.exe (GrantedAccess: " . GrantedAccess . ")"
| table _time, Computer, SourceImage, GrantedAccess, count, alert

Event 22 — DNS Query

SPL query — detect DGA domains (high entropy subdomains):

index=windows sourcetype=WinEventLog:Sysmon EventCode=22
| eval subdomain = mvindex(split(QueryName, "."), 0)
| eval entropy = len(subdomain) / log(36) * count
| where len(subdomain) > 15
| stats count by Computer, Image, QueryName
| eval alert = "MEDIUM — High-entropy subdomain: " . QueryName . " from " . Image
| table _time, Computer, Image, QueryName, count, alert

Sysmon Data Flow

Windows Endpoint
  │
  ├── Sysmon driver → Sysmon Event Log (Applications and Services Logs > Microsoft > Windows > Sysmon/Operational)
  │
  ├── Windows Event Forwarding (WEF) → Centralized collector → SIEM (Splunk/Sentinel/Elastic)
  │
  └── Direct forwarding via WinRM → SIEM forwarder

Analyst → SIEM search → Sysmon Event IDs → Correlation → Alert

Key Integration Points

Common Deployment Mistakes

Related

• Azure Sentinel — detection and response for T1654 techniques
• Cobalt Strike — Detection and Beacon Analysis — detection and response for T1055, T1572, T1071 techniques
• Common Ports and Protocols — covers the common ports and protocols concepts
• DNS — detection and response for T1572, T1568 techniques
• EDR Basics — detection and response for T1059, T1003, T1055, T1204, T1562 techniques

Sources

• Sysmon Documentation — Microsoft
• SwiftOnSecurity Sysmon Configuration
• Olaf Hartong Sysmon Modular
• TrustedSec Sysmon Community Guide
• MITRE ATT&CK T1654