Sysmon
A Sysinternals service that logs detailed process, network and file activity to the Windows event log.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
2 more ways to get Sysmon
Other download sites
Run by third parties, not by Microsoft. Prefer the official page above when it works.
Package managers
- Chocolatey
choco install sysmon
About Sysmon
System Monitor (Sysmon) is a Windows service and device driver that stays installed across reboots and records system activity to the Windows event log. It captures process creations, network connections and changes to file creation times, among other events.
The logs are meant to be collected with Windows Event Collection or a SIEM agent and analysed to spot malicious or anomalous activity. A separate Sysmon for Linux is published on GitHub.
Strengths
- Detailed process and network event logging
- Persists across reboots as a service and driver
- Integrates with SIEM tools through the event log
- Actively updated by Microsoft
Limitations
- No built-in interface for viewing or analysing events
- Needs a configuration file tuned to avoid noisy logs
Details
- Pricing
- FreeFree download from Microsoft Sysinternals.
- License
- Proprietary
- Developer
- Microsoft
- Platforms
- Windows, Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Administrators and defenders collecting endpoint telemetry on Windows
- Categories
- System monitoring, Security tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to Sysmon
Compare allSoftware that can replace Sysmon for an important use case, and what changes if you switch.
Wazuh Agent
Endpoint agent that feeds a Wazuh server with security and compliance data.
Wazuh Agent is open source under GPL-2.0 and adds file integrity monitoring and rootkit detection, but requires a Wazuh manager and indexer to be useful.
Velociraptor
Endpoint monitoring and digital forensics platform driven by a query language.
Velociraptor is an AGPL-3.0 endpoint monitoring and forensics platform with its own query language, running on Windows, macOS and Linux, and needing fleet deployment planning.
Similar software
Related functionality, not necessarily a direct replacement.
Chainsaw
Search Windows forensic records for suspicious activity.
Hayabusa
Build investigation timelines from Windows event logs.
Autoruns
A Sysinternals utility that shows every program and driver configured to start automatically on Windows.
Tracee
A Linux runtime security and forensics tool that traces system events using eBPF.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Falco
Detect unusual runtime behavior on Linux systems.
