<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: configuring-sysmon-monitoring
description: >-
  Deploy and configure Sysmon for advanced Windows endpoint telemetry.
  Covers configuration XML authoring, event ID filtering, performance
  tuning, and integration with SIEM pipelines for detection engineering.
domain: cybersecurity
subdomain: blue-team
tags:
  - sysmon
  - endpoint-security
  - windows
  - detection-engineering
  - telemetry
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562.001"]
---

# Configuring Sysmon Monitoring

## Overview

Sysmon (System Monitor) is a Windows system service that logs detailed process,
network, file, registry, and driver activity to the Windows Event Log. It provides
telemetry far beyond native Windows auditing, making it essential for threat
detection and incident response.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Sysmon binary | [Sysinternals download](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon) |
| Admin privileges | Required for installation |
| XML config file | Detection rules and filters |
| SIEM forwarder | Ship events to central platform |

## Key Concepts

### Event ID Reference

| EID | Event | Detection Value |
|---|---|---|
| 1 | Process Creation | Command lines, parent-child trees |
| 2 | File Creation Time Changed | Timestomping (T1070.006) |
| 3 | Network Connection | Outbound C2, lateral movement |
| 5 | Process Terminated | Process lifecycle tracking |
| 6 | Driver Loaded | Rootkit detection |
| 7 | Image Loaded | DLL sideloading (T1574.002) |
| 8 | CreateRemoteThread | Process injection (T1055) |
| 10 | ProcessAccess | Credential dumping targeting lsass |
| 11 | FileCreate | Malware drops, staging directories |
| 12-14 | Registry Events | Persistence mechanisms |
| 15 | FileCreateStreamHash | ADS abuse (T1564.004) |
| 17-18 | Pipe Events | Named pipe lateral movement |
| 22 | DNS Query | DNS-based C2 detection |
| 23 | FileDelete (archived) | Anti-forensics, ransomware |
| 25 | Process Tampering | Process hollowing, herpaderping |
| 26 | FileDeleteDetected | File deletion logging |

### Configuration Structure

```xml
<Sysmon schemaversion="4.90">
  <HashAlgorithms>sha256,imphash</HashAlgorithms>
  <DnsLookup>False</DnsLookup>

  <EventFiltering>
    <!-- Process Creation — log all, exclude noise -->
    <RuleGroup name="ProcessCreate" groupRelation="or">
      <ProcessCreate onmatch="exclude">
        <Image condition="is">C:\Windows\System32\svchost.exe</Image>
        <ParentImage condition="is">C:\Windows\System32\services.exe</ParentImage>
      </ProcessCreate>
    </RuleGroup>

    <!-- Network Connection — focus on suspicious -->
    <RuleGroup name="NetworkConnect" groupRelation="or">
      <NetworkConnect onmatch="include">
        <DestinationPort condition="is">4444</DestinationPort>
        <DestinationPort condition="is">8080</DestinationPort>
        <Image condition="contains">powershell</Image>
        <Image condition="contains">cmd.exe</Image>
      </NetworkConnect>
    </RuleGroup>

    <!-- ProcessAccess — credential dumping detection -->
    <RuleGroup name="ProcessAccess" groupRelation="or">
      <ProcessAccess onmatch="include">
        <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
      </ProcessAccess>
    </RuleGroup>

    <!-- DNS Query — log all for hunting -->
    <RuleGroup name="DnsQuery" groupRelation="or">
      <DnsQuery onmatch="exclude">
        <QueryName condition="end with">.microsoft.com</QueryName>
        <QueryName condition="end with">.windows.com</QueryName>
      </DnsQuery>
    </RuleGroup>

    <!-- File Create — monitor staging directories -->
    <RuleGroup name="FileCreate" groupRelation="or">
      <FileCreate onmatch="include">
        <TargetFilename condition="contains">\AppData\Local\Temp\</TargetFilename>
        <TargetFilename condition="contains">\Downloads\</TargetFilename>
        <TargetFilename condition="end with">.exe</TargetFilename>
        <TargetFilename condition="end with">.dll</TargetFilename>
        <TargetFilename condition="end with">.ps1</TargetFilename>
      </FileCreate>
    </RuleGroup>
  </EventFiltering>
</Sysmon>
```

### Installation Commands

```powershell
# Install with configuration
sysmon64.exe -accepteula -i sysmonconfig.xml

# Update running configuration
sysmon64.exe -c sysmonconfig.xml

# View current configuration
sysmon64.exe -c

# Uninstall
sysmon64.exe -u
```

### Community Configurations

| Config | Focus | URL |
|---|---|---|
| SwiftOnSecurity | Balanced noise/visibility | github.com/SwiftOnSecurity/sysmon-config |
| Olaf Hartong (modular) | Modular, customizable | github.com/olafhartong/sysmon-modular |
| ion-storm | High-fidelity detection | github.com/ion-storm/sysmon-config |

## Workflow

1. **Baseline** — Deploy SwiftOnSecurity config as starting point
2. **Tune** — Exclude known-good noise from your environment
3. **Enrich** — Add include rules for high-value detections (lsass access, named pipes)
4. **Test** — Run atomic red team tests, verify events appear
5. **Forward** — Configure WEF or agent to ship Sysmon channel to SIEM
6. **Monitor** — Track event volume; tune if EPS exceeds capacity

## Detection

```yaml
title: Sysmon Monitoring Detection
id: a1a549f8-fe8b-481f-bd20-effa6f7164e6
status: experimental
description: Detects suspicious activity related to configuring sysmon monitoring techniques in blue team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*configuring*sysmon*"
  condition: selection
level: medium
tags:
  - attack.t1562.001
  - attack.defense_evasion
falsepositives:
  - Security team running authorized detection validation tools
```

## Verification

| Check | Method |
|---|---|
| Sysmon running | `sc query sysmon64` — state RUNNING |
| Config loaded | `sysmon64 -c` — shows current rules |
| Events generating | `Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 5` |
| Hash algorithms | Verify `sha256,imphash` in config |
| SIEM receiving | Search for Sysmon EventID 1 in target platform |

## References

- [Sysmon Documentation](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)
- [SwiftOnSecurity Sysmon Config](https://github.com/SwiftOnSecurity/sysmon-config)
- [TrustedSec Sysmon Community Guide](https://github.com/trustedsec/SysmonCommunityGuide)
