Sysmon Security Monitoring in Practice: Windows Process Activity and Event Log Auditing

Sysmon is a kernel-level logging tool from Microsoft Sysinternals. It records process creation, network connections, file writes, and other high-value behaviors. This guide covers install, rule config, event queries, and IR practice so Windows servers get auditable behavior tracing.

Scope

Sysmon security monitoring applies to: routine Windows server security audit; malware behavior analysis and IR forensics; blue-team reconstruction of attacker process trees and outbound connections; ingesting Windows host behavior logs into a SIEM (Wazuh, Splunk) for correlation. Sysmon runs at the kernel-driver layer. Logging granularity far exceeds native Security logs. It is the de facto standard component for Windows endpoint security monitoring.

Prerequisites

• Windows 10 / Windows Server 2016 or later, administrator privileges
• Latest Sysmon from the Microsoft Sysinternals site
• Windows Event Log service running

How it works

Sysmon captures syscall-level activity via a kernel driver and writes to the Windows Event Log (Operational). Core Event IDs: 1 Process Create (command line, parent process), 3 Network Connect (src/dst IP and port), 11 File Create, 13 Registry value set, 22 DNS Query, 23 File Delete. Default install records events only. Detection and filtering are fully driven by the XML config. Include/Exclude rules pin the behaviors you care about, balancing volume vs performance.

Procedure

1. Download and install Sysmon

# Run in elevated PowerShell
# Download Sysmon and config (SwiftOnSecurity config, widely used in the community)
Invoke-WebRequest -Uri https://download.sysinternals.com/files/Sysmon.zip -OutFile Sysmon.zip
Expand-Archive Sysmon.zip -DestinationPath .\sysmon
cd .\sysmon

# Install and load default config
.\sysmon64.exe -accepteula -i ..\sysmon-config.xml

2. Verify install and config

# Print current config summary
.\sysmon64.exe -c

# View Sysmon logs in Event Viewer
# Path: Event Viewer - Applications and Services Logs - Microsoft - Windows - Sysmon - Operational

3. Core event queries (PowerShell)

# Query recent Process Create events (Event ID 1)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} -MaxEvents 20 |
  Select-Object TimeCreated, @{n='Process';e={$_.Properties[4].Value}},
                @{n='CmdLine';e={$_.Properties[5].Value}},
                @{n='Parent';e={$_.Properties[15].Value}} | Format-List

# Query suspicious outbound connections (Event ID 3), filter by dest port
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=3} -MaxEvents 50 |
  Where-Object { $_.Message -match 'DestPort: 4444|DestPort: 3389' }

4. Sample config rules

<!-- Record all process creates, exclude built-in system processes -->
<ProcessCreate onmatch="exclude">
  <Image condition="is">C:\Windows\System32\conhost.exe</Image>
</ProcessCreate>

<!-- Focus on PowerShell and outbound network -->
<NetworkConnect onmatch="include">
  <Image condition="contains">powershell.exe</Image>
</NetworkConnect>

Config verification

# Reload modified config
.\sysmon64.exe -c ..\sysmon-config.xml

# Trigger one event to confirm logging: start cmd then exit
cmd /c echo sysmon-test
# Then query Event ID 1; confirm command line contains sysmon-test

Verification checklist: new records exist in the event log; `-c` output shows config loaded; if write performance is a concern, watch event-log growth rate and tighten onmatch when rules are too broad.

FAQ

Q1: Does Sysmon hurt server performance?

Sysmon itself is cheap. High event volume increases Event Log write pressure. Start from a mature community config (SwiftOnSecurity), then trim exclude rules to the business. Cap high-frequency paths (temp-dir file creates) separately to avoid log explosion.

Q2: Command-line fields are truncated in Event Viewer. Fix?

Event Viewer truncates by default. Use Get-WinEvent and read the `Properties` array for full fields, or export XML with `wevtutil qe Microsoft-Windows-Sysmon/Operational /f:xml`. For SIEM ingest, consume XML so fields stay complete.

Summary

Sysmon closes the native Windows logging gap on behavior audit at very low cost. Process trees, network connections, DNS queries, and related events become fully traceable. Pair a trimmed rule set with centralized SIEM collection to raise threat detection and IR capability on Windows. After install, periodically review rules and log volume so monitoring stays effective.