Sysmon — Installation, Config XML, Event Types 1–29

Sysmon (System Monitor) is a Windows system service and device driver that extends Windows event logging with dramatically higher fidelity. Where native Windows logs tell you “a process started,” Sysmon tells you the file hash, the command line, the parent’s GUID, and a stack trace.

Installing Sysmon

# Download from Microsoft Sysinternals
Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "Sysmon.zip"
Expand-Archive Sysmon.zip

# Install with a config
.\Sysmon64.exe -accepteula -i sysmonconfig.xml

# Update config without reinstalling
.\Sysmon64.exe -c sysmonconfig.xml

# Verify it's running
Get-Service Sysmon64

Events appear in: Applications and Services Logs → Microsoft → Windows → Sysmon → Operational EVTX path: Microsoft-Windows-Sysmon%4Operational.evtx

The Sysmon Event Type Reference

Anatomy of Sysmon Event 1 (Process Create)

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" />
    <EventID>1</EventID>
    <TimeCreated SystemTime="2024-03-15T09:23:14.882Z" />
    <Computer>WORKSTATION01.corp.local</Computer>
  </System>
  <EventData>
    <Data Name="RuleName">-</Data>
    <Data Name="UtcTime">2024-03-15 09:23:14.882</Data>
    <Data Name="ProcessGuid">{12345678-abcd-1234-abcd-123456789012}</Data>
    <Data Name="ProcessId">7124</Data>
    <Data Name="Image">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data>
    <Data Name="FileVersion">10.0.19041.1682</Data>
    <Data Name="Description">Windows PowerShell</Data>
    <Data Name="Product">Microsoft® Windows® Operating System</Data>
    <Data Name="Company">Microsoft Corporation</Data>
    <Data Name="OriginalFileName">PowerShell.EXE</Data>
    <Data Name="CommandLine">powershell.exe -NoP -sta -NonI -W Hidden -Enc SGVsbG8gV29ybGQ=</Data>
    <Data Name="CurrentDirectory">C:\Users\jdoe\</Data>
    <Data Name="User">CORP\jdoe</Data>
    <Data Name="LogonGuid">{87654321-dcba-4321-dcba-210987654321}</Data>
    <Data Name="LogonId">0x1F3A2</Data>
    <Data Name="TerminalSessionId">1</Data>
    <Data Name="IntegrityLevel">Medium</Data>
    <Data Name="Hashes">MD5=7353F60B1739074EB17C5F4DDDEFE239,SHA256=6F341AD06A31...</Data>
    <Data Name="ParentProcessGuid">{ABCDEF01-1234-5678-9ABC-DEF012345678}</Data>
    <Data Name="ParentProcessId">9004</Data>
    <Data Name="ParentImage">C:\Windows\explorer.exe</Data>
    <Data Name="ParentCommandLine">C:\Windows\Explorer.EXE</Data>
    <Data Name="ParentUser">CORP\jdoe</Data>
  </EventData>
</Event>

Note what 4688 doesn’t provide that Sysmon 1 does:

• File hash (MD5, SHA256, IMPHASH) — enables threat intel lookups
• ProcessGuid — enables reliable parent-child correlation across events
• OriginalFileName — the name the binary was compiled with (attacker can rename mimikatz.exe → svchost.exe, but OriginalFileName still shows mimikatz.exe)
• IntegrityLevel — whether the process is running elevated (High) or not (Medium)
• Always includes CommandLine — no extra policy required

The Sysmon Config XML Structure

Sysmon behavior is entirely controlled by an XML configuration file. Without a good config, Sysmon logs everything (massive volume) or nothing useful.

<Sysmon schemaversion="4.90">
  <HashAlgorithms>MD5,SHA256,IMPHASH</HashAlgorithms>
  <CheckRevocation>True</CheckRevocation>
  
  <EventFiltering>
    
    <!-- Process Create: log all, exclude known-good noisy processes -->
    <RuleGroup name="" groupRelation="or">
      <ProcessCreate onmatch="exclude">
        <Image condition="is">C:\Windows\system32\wermgr.exe</Image>
        <Image condition="is">C:\Windows\system32\audiodg.exe</Image>
        <CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine>
      </ProcessCreate>
    </RuleGroup>
    
    <!-- Network Connection: only log suspicious ports and processes -->
    <RuleGroup name="" groupRelation="or">
      <NetworkConnect onmatch="include">
        <DestinationPort condition="is">4444</DestinationPort>
        <DestinationPort condition="is">1337</DestinationPort>
        <Image condition="end with">powershell.exe</Image>
        <Image condition="end with">cmd.exe</Image>
      </NetworkConnect>
    </RuleGroup>
    
    <!-- Process Access: LSASS credential dumping detection -->
    <RuleGroup name="" groupRelation="or">
      <ProcessAccess onmatch="include">
        <TargetImage condition="is">C:\Windows\system32\lsass.exe</TargetImage>
      </ProcessAccess>
    </RuleGroup>
    
    <!-- Registry: run key persistence -->
    <RuleGroup name="" groupRelation="or">
      <RegistryEvent onmatch="include">
        <TargetObject condition="contains">CurrentVersion\Run</TargetObject>
        <TargetObject condition="contains">CurrentVersion\RunOnce</TargetObject>
        <TargetObject condition="contains">Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</TargetObject>
      </RegistryEvent>
    </RuleGroup>
    
    <!-- Exclude DNS queries from browsers — too noisy -->
    <RuleGroup name="" groupRelation="or">
      <DnsQuery onmatch="exclude">
        <Image condition="end with">chrome.exe</Image>
        <Image condition="end with">firefox.exe</Image>
        <Image condition="end with">msedge.exe</Image>
      </DnsQuery>
    </RuleGroup>
    
  </EventFiltering>
</Sysmon>