LOADING N0PERM…
Windows system service and device driver from Microsoft Sysinternals that monitors and logs system activity to the Windows event log, tracking process creation, network connections, and file changes.
A standard WINDOWS utility used across offensive reconnaissance, packet forensics, and defensive system administration.
Direct visibility into network interfaces, protocol frames, access controls, or filesystem structures without graphical overhead.
During live system triage, initial reconnaissance, forensic capture inspection, or baseline configuration auditing.
# Download from Microsoft Sysinternals or install via winget
winget install Microsoft.Sysinternals.Sysmon
# Install service with SwiftOnSecurity configuration
sysmon.exe -accepteula -i sysmonconfig-export.xmlHigh-fidelity event IDs:
- Event ID 1: Process Creation (CLI arguments, parent process, hashes)
- Event ID 3: Network Connection initiated by process
- Event ID 7: Image Loaded (DLL injection detection)
- Event ID 11: FileCreate (Drop of malware / script)
- Query with PowerShell: Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} -MaxEvents 10