Sysmon

Description

System Monitor (Sysmon) is a Windows system service and device driver which, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time.

Purpose

Sysmon is used to monitor process creations, network connections and other events of interest in DetectionLab.

Configuration Details

  • Olaf Hartong’s Sysmon Modular is used at the primary Sysmon configuration
  • Sysmon is installed as a service on the Windows hosts

Data Location

  • Splunk
    • index=sysmon