# Sysmon Installation

### **What is Sysmon?**

* Sysmon (System Monitor) is a Windows system service that logs system activities like process creation, network connections, and file changes. It provides detailed event logs that help detect malicious activity and security threats.

### **Why Use Sysmon?**

* **Advanced Logging** – Records system activities beyond standard Windows logs.
* **Security Monitoring** – Detects malware, suspicious scripts, and unauthorized access.
* **Forensic Analysis** – Helps in investigating security incidents.
* **Lightweight & Free** – Runs efficiently without slowing down the system.

## Install Sysmon

### **Step 1: Download Sysmon**

1. Open a web browser and visit the [Sysmon download page](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon).
2. Click **Download Sysmon**.
3. If using Linux, download it from the official GitHub repository.

### **Step 2: Download the Configuration File**

1. Go to the [sysmon-config.xml GitHub page](https://raw.githubusercontent.com/olafhartong/sysmon-modular/refs/heads/master/sysmonconfig.xml).
2.  Click **Raw**, then right-click and choose **Save As, name it whatever you want**.\
    \


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FuO5x0lK6EJPmDgnck0Gm%2Fimage.png?alt=media&#x26;token=bac53a54-6bd5-4578-92d8-4f2987485d83" alt=""><figcaption></figcaption></figure>
3. You can save it as `sysmonconfig`.

### **Step 3: Extract Sysmon**

1. Right-click the downloaded **Sysmon ZIP** file.
2.  Select **Extract All** and choose a location.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Fy0YTTQbf4g2tmnjLeZZU%2Fimage.png?alt=media&#x26;token=6e91d452-cc2b-4b2a-8e25-3b886c8283a3" alt=""><figcaption></figcaption></figure>

### **Step 4: Open PowerShell as Administrator**

1. Click the **Windows Start Button**.
2. Type **PowerShell**, then right-click and select **Run as Administrator**.
3. Click **Yes** to allow changes.

### **Step 5: Navigate to the Sysmon Directory**

1.  In PowerShell, use the `cd` command to change to the extracted Sysmon folder:

    ```powershell
    cd "C:\Users\YourUser\Downloads\Sysmon"
    ```

### **Step 6: Move the Configuration File**

Ensure `sysmonconfig` is inside the same directory as `Sysmon64.exe`.\


<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Fydh5pnjspMjQ6DD4h6E0%2Fsss.png?alt=media&#x26;token=eb113b31-0337-40bd-9974-dcd466b6769c" alt=""><figcaption></figcaption></figure>

### **Step 7: Install Sysmon with the Configuration**

Run the following command in PowerShell:

```powershell
.\Sysmon64.exe -i sysmonconfig.xml
```

Accept the license agreement when prompted.\


<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F5swvejiBr8vQXSbmKWAE%2F1.png?alt=media&#x26;token=a65013da-173d-4775-bf00-e54433d9067d" alt=""><figcaption></figcaption></figure>

### **Step 8: Verify Sysmon Installation**

#### **1. Check Running Services**

* Open **Run** (`Win + R`), type `services.msc`, and press **Enter**.
* Look for **Sysmon** in the list.

#### **2. Check Event Logs**

* Open **Run** (`Win + R`), type `eventvwr.msc`, and press **Enter**.
*   Go to:

    ```
    Applications and Service Logs > Microsoft > Windows > Sysmon > Operational
    ```
*   If logs appear, Sysmon is working.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FxGS04g35F7PbhJVoUF8g%2F1.png?alt=media&#x26;token=ddcf50e6-df27-4a73-ba32-6a7a573abb48" alt=""><figcaption></figcaption></figure>

#### **3. Check via Command Line**

Run this in **PowerShell (Admin)**:\


```powershell
Get-Service Sysmon64
```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F5sHDpRJBuBjjp2wEMFVp%2Fimage.png?alt=media&#x26;token=120696b5-7674-49e8-b901-81dcaddc5bcf" alt=""><figcaption></figcaption></figure>

