FREE: Sysmon – New Sysinternals tool logs system activity in Event Log

• Author
• Recent Posts

Michael Pietroforte

Michael Pietroforte is the founder and editor in chief of 4sysops. He has more than 35 years of experience in IT management and system administration.

Latest posts by Michael Pietroforte (see all)

• Pip install Boto3 - Thu, Mar 24 2022
• Install Boto3 (AWS SDK for Python) in Visual Studio Code (VS Code) on Windows - Wed, Feb 23 2022
• Automatically mount an NVMe EBS volume in an EC2 Linux instance using fstab - Mon, Feb 21 2022

The main purpose of the free tool is to analyze a machine with suspicious behavior. Sysmon appears to be a command-line utility; however, sysmon.exe is just the installer for the Sysmon service. To install Sysmon, you just launch the command with the parameter -i:

sysmon -i

Sysmon installation

This will configure Sysmon to only log the creation of Windows processes and changes in file creation times. If you also want to monitor network connections, you have to add the parameter -n:

sysmon -i -n

You can also enable the networking monitoring feature at a later time:

sysmon -c -n

With sysmon -c, you can view the configuration of the service:

Sysmon configuration

Once the Sysmon service is running, you can find its Event Log entries in the Windows Event Viewer at Applications and Services Logs > Microsoft > Windows > Sysmon > Operational. Event ID 1 stands for process creations, event ID 2 indicates file creation time changes, and event ID 3 indicates network connections.

Windows processes are created whenever you launch an application. Thus, you will see quite a few of such entries in the Event Log.

Process creation event

As you can see in the screenshot, you get detailed information about the process.

Malware and hackers sometimes change the creation time of files to cover their activities. If you want to try this Sysmon feature, you can change the creation time of a file (named test.txt in the example) with this PowerShell command:

(Get-Item test.txt).CreationTime = "Saturday, August 9, 2014 6:51:04 AM"

Changed file creation time

Note that the creation time in the Event Log uses UTC time even if your computer is in another time zone.

The network connection log entries give you detailed information about the program that established the connection and the protocol it used.

Network connection detected

You can uninstall the Sysmon service with the -u parameter:

sysmon -u

Sysmon uninstall

Sysmon