System Monitor (Sysmon) is a free Microsoft Sysinternals service and device driver that records detailed endpoint telemetry, process creations, network connections, file and registry activity, and more.
Since NT 3.1, Windows has always provided auditing, especially for changes to the system. Each area of visibility needs its own switch: an audit policy for process creation, SACLs on each folder and registry key you want watched, Windows Filtering Platform auditing for network events that arrive in overwhelming volume. Whole categories, DNS by process, WMI persistence, named pipes, module loads, have no practical built-in auditing at all.
Sysmon, released by Microsoft's Sysinternals team in 2014, replaced that patchwork with one system service and driver, one XML configuration, and a dedicated event channel carrying about thirty event types. Process creation, an area increasingly relevant for security, is only one slice of it. EventSentry monitors all Sysmon events, with the full context of the system, and turns key patterns into email alerts and detailed reports.
| Category | Built-in auditing | Sysmon |
|---|---|---|
| Process creation | 4688 + policy | Event ID 1: hashes, OriginalFileName, parent cmdline |
| Network connections | 5156 via WFP, very noisy | Event ID 3, per process |
| DNS queries | resolver logs, host-level | Event ID 22, per process |
| File activity | 4663 + per-folder SACLs | Event IDs 11, 15, 23, 26 |
| Registry changes | 4657 + per-key SACLs | Event IDs 12 to 14 |
| Module and driver loads | -- | Event IDs 6, 7 + signatures |
| Cross-process access | not practical | Event IDs 8, 10 + call trace |
| Named pipes | -- | Event IDs 17, 18 |
| WMI persistence | -- | Event IDs 19 to 21 |
| Payload swap after creation | -- | Event ID 25 |
| Sensor tamper protection | n/a | protected process, v15+ |
Before Sysmon, each kind of visibility had its own mechanism: an audit policy for process creation, SACLs on every folder and registry key you wanted watched, Windows Filtering Platform auditing for network events. Sysmon replaced the patchwork with one signed service and driver, configured by one XML file, writing about thirty event types, spanning processes, network connections, files, the registry, DNS, WMI, named pipes, and drivers, to a dedicated event channel your existing forwarding already carries.
Renaming the binary is the first thing an operator does, because built-in process auditing records only the path the attacker chose. Sysmon's process-creation event adds OriginalFileName, read from the executable's own version resource, plus MD5, SHA-256, and IMPHASH hashes and the parent's full command line. The tool can be called anything on disk; the telemetry still says procdump, and the hash still matches the known tool.
Stealing passwords from LSASS memory never creates a process, so process auditing sees nothing at all. Sysmon Event ID 10 records the handle open itself: which process touched lsass.exe, with what access mask, through what call stack. The masks are nearly fingerprints, 0x1010 for Mimikatz-style reads, and Microsoft's own detection guidance is built around catching this exact sequence.
The quiet autostarts live outside the process log: a run key, a scheduled WMI event consumer, a named pipe waiting for its operator. Built-in auditing needs a SACL on every registry key you thought to watch and has no practical story for WMI or pipes at all. Sysmon covers them as first-class events: registry create, set, and rename (Event IDs 12 to 14), pipe creation and connection (17 and 18), and the WMI filter, consumer, and binding trio (19 to 21).
Resolver and firewall logs say the host queried a domain. Sysmon Event ID 22 says powershell.exe queried it, under which user. That turns a reputation hit on a domain into a process and an account, not just a machine. Beaconing detection, DGA spotting, and newly-registered-domain rules all arrive with an owner attached before the investigation starts.
Sysmon's network connection event links every TCP and UDP connection to the process that made it and the user it ran as, with hostnames and ports on both ends. The built-in alternative, Windows Filtering Platform auditing, produces overwhelming volume with far less context. Event ID 3 ships disabled by default, so it costs nothing until you scope it to the ports and processes you care about.
Hollowing and herpaderping launch a legitimate binary, then swap its code in memory. Every process-creation record faithfully describes the decoy. Event ID 25 was added precisely for this: it fires when a process image is changed after creation, flagging the moment the clean-looking svchost becomes something else. The technique's entire purpose is defeating the process log.
The hardest part of Sysmon is deciding what to include and exclude, and the community already did the work in public. The sysmon-modular project maintains a modular configuration mapped to MITRE ATT&CK techniques, and the widely deployed SwiftOnSecurity baseline encodes years of tested excludes for common enterprise software. Starting from either means your first week of telemetry is signal, not a firehose.
Sysmon deliberately stops at telemetry: it does not analyze or notify. EventSentry monitors the event stream, evaluates every event on arrival, and turns matches into email alerts and automated responses, with as much or as little automation as you want, per rule.
EventSentry monitors the full Sysmon event log, process, network, DNS, files, registry, WMI, pipes, and drivers, via the EventSentry agent, with per-host reporting health so a quiet sensor is visible immediately.
A rule match notifies the right team, on-call, SOC inbox, or both, with the process, user, host, and raw event in the message. Thresholds, digests, and quiet hours keep the volume reasonable.
Per rule, a match can also act: disable the account, isolate the host, stop the process, or run your script, each with simulation mode, approval gates, and rollback. Alert-only is always a valid configuration.
Manage your cookie preferences below:
To learn more about our use of cookies, please see our
Privacy Policy.