Glossary
Sysmon
Microsoft Sysinternals System Monitor: a free driver and service that logs detailed process, network, file, registry and DNS activity to the Windows event log.
Sysmon (System Monitor) is a free tool from Microsoft Sysinternals, and since 2026 also a built-in optional feature of Windows 11 and Windows Server 2025, off by default. Installed as a service with a kernel driver, it writes detailed telemetry to the Microsoft-Windows-Sysmon/Operational log: process creation with hashes and full parent information (event 1), network connections (3), process access such as reads of LSASS (10), file creation (11), registry changes (12-14), DNS queries (22) and process tampering (25), among others.
What it records is defined by an XML configuration; community-maintained configurations are the usual starting point. Sysmon gives defenders EDR-like visibility for investigations and SIEM detections without a commercial agent, as long as its events are forwarded off the host.
See the audit policy and Sysmon guide.