Description
After a compromise, working out what actually happened is hard when the default Windows logs lack detail. Sysmon (System Monitor) stays resident and writes system activity — process creation, network connections, file and registry changes — into the event log in detail, with command lines, file hashes and parent-child process chains, so where suspicious behavior came from and what it spawned is clear.
An XML config filters to just the events you care about, and paired with a SIEM it is a common building block for endpoint detection and incident response. From Microsoft Sysinternals, free.
Deep activity logging: Records process creation, network connections, driver/DLL loads, and file and registry changes to the Windows event log.
Threat tracing: Every entry carries the command line, file hash and parent-child chain to reconstruct intrusions and suspicious behavior.
Rule-based filtering: An XML config precisely selects which events to record, cutting noise for long-term collection.
SIEM-ready: Logs flow through the event channel for collection by SIEM/log platforms, supporting endpoint detection and response.
An XML config filters to just the events you care about, and paired with a SIEM it is a common building block for endpoint detection and incident response. From Microsoft Sysinternals, free.
Features
Deep activity logging: Records process creation, network connections, driver/DLL loads, and file and registry changes to the Windows event log.
Threat tracing: Every entry carries the command line, file hash and parent-child chain to reconstruct intrusions and suspicious behavior.
Rule-based filtering: An XML config precisely selects which events to record, cutting noise for long-term collection.
SIEM-ready: Logs flow through the event channel for collection by SIEM/log platforms, supporting endpoint detection and response.
