Sysmon turns Windows into a flight recorder. It logs every process launch, network connection, file creation and registry change to the Windows Event Log, which gives you the evidence ransomware crews usually erase. As of October 22, 2026, Microsoft lists Sysmon v15.22 (dated September 10, 2026) as the current standalone release, and Windows 11 version 26H2 now ships a built-in copy that is switched off by default. This tutorial walks through a full Sysmon setup in 13 steps, with a working configuration tuned for ransomware behavior.What Sysmon Does and What Changed in 2026Prerequisites and Versions You NeedSteps 1 and 2: Pick Your Install Path and Download SysmonSteps 3 and 4: Build a Baseline Sysmon ConfigurationSteps 5 and 6: Install Sysmon and Confirm Events FlowSysmon Event IDs Worth KnowingStep 7: Add Ransomware Detection RulesSteps 8 and 9: Query Sysmon Logs and Tune Out NoiseStep 10: Forward Sysmon Events to a Central CollectorStep 11: Test Your Detections With a Safe SimulationSteps 12 and 13: Update Sysmon and Harden It Against TamperingComplete Working Project: One-Script Sysmon DeploymentCommon Pitfalls to AvoidTroubleshooting: 10 Sysmon Problems and FixesAdvanced Tips for Sysmon Power UsersFrequently Asked Questions About Sysmon
You will finish with a Sysmon install, a tested config file, PowerShell hunting queries and a deployment script you can push to a fleet. Microsoft refreshed the Sysinternals Suite on October 15, 2026, and a Greek-language write-up of that release confirms the Suite still bundles Sysmon next to Process Monitor and Autoruns. If you also want the preventive side, our guide on how to protect against ransomware covers backups, patching and access control. Sysmon covers the other half: seeing the attack while it runs.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.
One email a week. No spam, unsubscribe anytime.
Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Add Now
What Sysmon Does and What Changed in 2026
Sysmon, short for System Monitor, is a Sysinternals utility that installs as a Windows service and a kernel driver. Once running, it stays resident across reboots and writes detailed events to its own Windows Event Log channel. Microsoft’s documentation describes it as a tool that monitors and reports key system activity through the Windows Event Log. Standard Windows logging tells you a process started. Sysmon tells you the full command line, the parent process, the file hash and the user context.
That detail matters for ransomware. Encryption itself happens fast, often in minutes. The warning signs come earlier: a script interpreter spawned by an Office app, a new service installed, shadow copies deleted, a burst of file renames. Sysmon records each of those steps, so a good configuration lets you catch the intrusion before the encryption stage.
Three 2026 changes shape how you should deploy it today:
You may like
Built-in Sysmon on Windows 11 26H2. On September 29, 2026, Microsoft documented System Monitor as a feature inside Windows 11 version 26H2 (also called the Windows 11 2026 Update). It is off by default, accepts custom configuration files and writes events to the Windows Event Log. Microsoft also describes it as an optional feature on Windows Server 2025.Standalone Sysmon v15.22. The Sysinternals utilities index lists v15.22, dated September 10, 2026, as the newest standalone build. It monitors and reports system activity through the Windows Event Log.Microsoft Store distribution. The Store listing shows Sysinternals Suite version 2026.10, released October 15, 2026, as an MSIX bundle that includes Sysmon.
Microsoft’s pages list no separate price or paid plan for Sysmon. You pay in engineering time and log storage, not licenses. One caution: the sources we checked do not confirm that built-in Sysmon changes the config schema, so test any configuration on a real 26H2 machine before you roll it out.
Prerequisites and Versions You Need
Gather the following before you start. Everything here runs on a single test machine, which is the right place to begin. Do not push an untested Sysmon config to production endpoints.
RequirementVersion or detailWhy it mattersSysmon (standalone)v15.22, dated September 10, 2026Newest standalone build Microsoft listsSysinternals Suite (Store)Version 2026.10, October 15, 2026Alternative install path via Microsoft StoreWindows clientWindows 11 26H2 for built-in Sysmon, or any supported Windows later than Windows 7Sysmon is not available on Windows 7 and earlierWindows ServerWindows Server 2019 or higher, Server 2025 for the built-in optionMicrosoft’s page lists Server 2019 and upRightsLocal administratorInstalling the driver needs elevationDownload size192.2 MB (Suite), 21.3 MB (ARM64), 9.8 MB (Nano Server)Plan for the right package on ARM and NanoShellWindows PowerShell or PowerShell 7Used for queries and the deployment script
You also need a text editor that handles XML, a second machine or VM if you want to forward logs, and about 30 minutes of uninterrupted time for the test steps. A virtual machine snapshot taken before Step 11 gives you a clean rollback.
Steps 1 and 2: Pick Your Install Path and Download Sysmon
Step 1: Decide between built-in and standalone Sysmon. If your fleet runs Windows 11 26H2 or Windows Server 2025, the built-in feature removes the need to distribute a binary. If you run older supported Windows versions, or you want one install method everywhere, use the standalone package. This tutorial uses the standalone v15.22 build because it works across the widest range of machines, and the configuration file is identical in both cases.
For the built-in route, enable the optional feature and then load your config. We could not confirm the exact toggle name or command in the Microsoft pages we fetched today, so read the current Sysmon page on Microsoft Learn before scripting it. Do not copy a command from an old blog post, because many pre-2026 articles assume Sysmon is always a separate download.
Step 2: Download and verify the standalone package. Grab the Sysmon archive from the Sysinternals downloads page on Microsoft Learn, or install the Suite from the Microsoft Store. Then verify what you downloaded. Open PowerShell and check the signature on the binary:
# Create a working folder and extract the download into it
New-Item -ItemType Directory -Path C:\Sysmon -Force | Out-Null
Expand-Archive -Path "$env:USERPROFILE\Downloads\Sysmon.zip" -DestinationPath C:\Sysmon -Force
# Confirm the binary is signed by Microsoft
Get-AuthenticodeSignature C:\Sysmon\Sysmon64.exe | Format-List Status, SignerCertificate
# Print the file version, which should read 15.22 or newer
(Get-Item C:\Sysmon\Sysmon64.exe).VersionInfo.FileVersion
Expected output looks like this:
Status : Valid
SignerCertificate : [Subject]
CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
15.22
If the status reads anything other than Valid, delete the folder and download again from the official page. Attackers do publish trojanized copies of popular admin tools, so this ten-second check is worth keeping in your routine. Use Sysmon64.exe on 64-bit Windows, Sysmon.exe on 32-bit and Sysmon64a.exe on ARM64 systems.
Steps 3 and 4: Build a Baseline Sysmon Configuration
Sysmon does almost nothing useful without a configuration file. With no config, it logs a thin default set and misses most of what you care about. With a bad config, it floods the disk. The goal for this section is a lean baseline that records process creation broadly and records the other event types selectively.
Step 3: Understand how rules work. Each event type lives in a RuleGroup with an onmatch attribute. Set onmatch to exclude and Sysmon logs everything except what matches your rules. Set it to include and Sysmon logs only what matches. Use exclude for event types where you want broad visibility (process creation) and include for noisy ones (network connections, file creation, registry writes).
Step 4: Write the baseline file. Save the following as C:\Sysmon\sysmon-baseline.xml. It hashes files with SHA256, logs all process starts except a few high-volume Windows noise sources, and captures only suspicious network, file, registry and memory-access events.
SHA256
C:\Windows\System32\conhost.exe
C:\Windows\System32\backgroundTaskHost.exe
"C:\Program Files\Sysmon\Sysmon64.exe"
\AppData\
\Users\Public\
\Temp\
\powershell.exe
\mshta.exe
\rundll32.exe
445
3389
\Start Menu\Programs\Startup\
\Users\Public\
.hta
.vbs
.ps1
\CurrentVersion\Run
\Services\
\Image File Execution Options\
C:\Windows\System32\lsass.exe
.microsoft.com
.windowsupdate.com
Before installing, validate the file. The Sysmon binary will reject malformed XML, but it is better to learn that from a clear error than from a half-applied config:
# Quick syntax check using PowerShell's XML parser
[xml]$cfg = Get-Content C:\Sysmon\sysmon-baseline.xml
$cfg.Sysmon.EventFiltering.RuleGroup.Count
# Print the schema version this Sysmon build supports
C:\Sysmon\Sysmon64.exe -s | Select-String "schemaversion"
The first command should print 6, one for each rule group. If your Sysmon build reports a different schema version than the one in your file, update the schemaversion attribute to match. The community-maintained configs published on GitHub, such as the long-running SwiftOnSecurity and Olaf Hartong sets, are good references once you understand the structure. Start from your own file first. Copying a 1,000-line config you have never read is how teams end up with blind spots they cannot explain.
Steps 5 and 6: Install Sysmon and Confirm Events Flow
Step 5: Install the service. Open an elevated PowerShell window. The -accepteula flag skips the license prompt, which matters for scripted installs, and -i installs the driver and service with your config:
cd C:\Sysmon
.\Sysmon64.exe -accepteula -i sysmon-baseline.xml
# Confirm the service and driver are running
Get-Service Sysmon64
Get-CimInstance Win32_SystemDriver -Filter "Name="SysmonDrv"" | Select-Object Name, State
A healthy install prints something close to the following:
System Monitor v15.22 - System activity monitor
By Mark Russinovich and Thomas Garnier
Copyright (C) 2014-2026 Microsoft Corporation
Sysmon64 installed.
SysmonDrv installed.
Starting SysmonDrv.
SysmonDrv started.
Starting Sysmon64..
Sysmon64 started.
Status Name DisplayName
------ ---- -----------
Running Sysmon64 Sysmon64
Name State
---- -----
SysmonDrv Running
The banner text above is illustrative. Your build prints its own version and copyright line. What matters is that both the service and the driver report Running.
Step 6: Generate a test event and find it. Open Notepad, then query the Sysmon log for the newest process-creation event:
Start-Process notepad.exe
Start-Sleep -Seconds 2
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 5 |
Where-Object Id -eq 1 |
Select-Object -First 1 TimeCreated, Id, Message |
Format-List
TimeCreated : 10/22/2026 3:41:07 PM
Id : 1
Message : Process Create:
RuleName: -
UtcTime: 2026-10-22 22:41:07.318
ProcessGuid: {8f1c2a6e-4b13-6718-5d02-000000001a00}
Image: C:\Windows\System32\notepad.exe
CommandLine: "C:\Windows\System32\notepad.exe"
ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Hashes: SHA256=...
Seeing the parent image and SHA256 hash confirms Sysmon is working. The Event Viewer path for the same log is Applications and Services Logs, Microsoft, Windows, Sysmon, Operational.
Sysmon Event IDs Worth Knowing
You will see a lot of numbers in the log. This table lists the event IDs that matter most for ransomware investigations and what each one tells you.
Event IDNameRansomware relevance1Process creationCommand lines for vssadmin, wmic, bcdedit, wbadmin3Network connectionCommand-and-control traffic, SMB spread on port 4457Image loadedMalicious DLL loading (very noisy, enable narrowly)8CreateRemoteThreadProcess injection into legitimate programs10Process accessCredential dumping from LSASS11File createdRansom notes, dropped payloads12, 13, 14Registry eventsRun-key persistence, service creation22DNS queryLookups of attacker domains23File delete (archived)Recover files an attacker deleted, if archiving is on255Sysmon errorDropped events, config problems
If you want portable detection logic that works beyond Sysmon, our walkthrough on how to write Sigma rules for threat detection shows how to express these same event patterns in a vendor-neutral format.
Step 7: Add Ransomware Detection Rules
The baseline gives you visibility. This step adds rules that tag ransomware behavior so it stands out when you search. Ransomware operators tend to repeat the same preparation moves: wipe backups, disable recovery, tamper with antivirus, then drop a ransom note in every folder. Each move leaves a Sysmon footprint.
Add these rule groups inside the EventFiltering element of your baseline file. The name attribute on each rule writes a label into the event’s RuleName field, which makes later filtering much faster. The technique IDs come from the MITRE ATT&CK framework.
README_TO_RESTORE;HOW_TO_DECRYPT;RESTORE_FILES;DECRYPT_INSTRUCTIONS
.locked
.encrypted
.crypt
DisableRealtimeMonitoring
DisableAntiSpyware
\SafeBoot\
Notice that the contains any condition takes a semicolon-separated list of values. That keeps the file short. The file-creation rules assume you already have an include group for FileCreate. Merge these entries into your existing FileCreate group instead of adding a second one if your build warns about duplicates.
Process creation is already fully logged, so you detect the backup-destruction commands by searching command lines. These are the patterns worth saving as search terms:
You may like
Command-line patternWhat the attacker wantsSeverityvssadmin delete shadowsDestroy Volume Shadow Copies so you cannot restore filesCriticalwmic shadowcopy deleteSame goal through WMICriticalwbadmin delete catalogErase the Windows Backup catalogCriticalbcdedit with recoveryenabled noDisable Windows recovery modeHighbcdedit with bootstatuspolicy ignoreallfailuresSuppress boot repair promptsHighpowershell with -enc or -EncodedCommandHide a payload in Base64Medium, tune per environmentcipher /wWipe free disk space to block file recoveryMedium
Real intrusions rarely stop at one machine, so pair this endpoint view with network controls. Our guide to network segmentation against ransomware explains how to keep a single compromised host from reaching your file servers, which is exactly the lateral movement your port 445 and 3389 rules in Sysmon will flag.
Steps 8 and 9: Query Sysmon Logs and Tune Out Noise
Step 8: Hunt with PowerShell. Event Viewer works for one-off checks, but PowerShell lets you filter fast and repeat the search. Save this helper as Find-SysmonRansom.ps1. It scans the last 24 hours of process-creation events for the backup-destruction patterns above:
param([int]$Hours = 24)
$patterns = @(
'vssadmin(\.exe)?\s+delete\s+shadows',
'wmic(\.exe)?\s+shadowcopy\s+delete',
'wbadmin(\.exe)?\s+delete\s+catalog',
'bcdedit.*recoveryenabled\s+no',
'bcdedit.*bootstatuspolicy\s+ignoreallfailures',
'cipher(\.exe)?\s+/w'
)
$regex = ($patterns -join '|')
$since = (Get-Date).AddHours(-$Hours)
Get-WinEvent -FilterHashtable @{
LogName="Microsoft-Windows-Sysmon/Operational"
Id = 1
StartTime = $since
} -ErrorAction SilentlyContinue | ForEach-Object {
$xml = [xml]$_.ToXml()
$data = @{}
$xml.Event.EventData.Data | ForEach-Object { $data[$_.Name] = $_.'#text' }
if ($data['CommandLine'] -match $regex) {
[pscustomobject]@{
Time = $_.TimeCreated
User = $data['User']
Image = $data['Image']
Command = $data['CommandLine']
Parent = $data['ParentImage']
}
}
} | Format-Table -AutoSize -Wrap
When it finds something, the output looks like this:
Time User Image Command Parent
---- ---- ----- ------- ------
10/22/2026 4:02:11 PM CORP\svc-backup C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet C:\Windows\System32\cmd.exe
A hit on delete shadows from a non-admin tool, a script or an unfamiliar parent deserves an immediate look. Legitimate backup software sometimes calls vssadmin too, so always read the parent process and the user before you panic.
Step 9: Measure noise and tune. After a day of running, count which programs generate the most events. The top few are your exclusion candidates:
Get-WinEvent -FilterHashtable @{
LogName="Microsoft-Windows-Sysmon/Operational"; StartTime=(Get-Date).AddDays(-1)
} -ErrorAction SilentlyContinue |
ForEach-Object {
$x = [xml]$_.ToXml()
($x.Event.EventData.Data | Where-Object Name -eq 'Image').'#text'
} |
Group-Object | Sort-Object Count -Descending |
Select-Object -First 10 Count, Name
Add an exclude rule only for a program you have verified, and prefer a full path over a bare file name. An attacker who renames malware to match your exclusion walks right past it. Repeat this tuning pass weekly for the first month, then monthly. Apply a changed file to a running install with Sysmon64.exe -c sysmon-baseline.xml, which reloads the config without a reinstall.
Step 10: Forward Sysmon Events to a Central Collector
Local logs have one fatal flaw. Ransomware that gains admin rights can clear the event log on the infected machine, and your evidence disappears with it. Forwarding events to a separate system within seconds closes that gap. You have three realistic options, and the right one depends on what you already run.
Windows Event Forwarding (WEF). Free, built into Windows and well suited to Active Directory shops. A collector server pulls events from endpoints over WinRM.An agent such as Winlogbeat or the Splunk forwarder. Works without a domain and ships to Elastic, Splunk or similar platforms.A vendor-managed pipeline. Microsoft announced its Integrated Security Operations Center in Defender on September 23, 2026. Per Microsoft’s announcement, it brings SIEM and threat protection together in one experience, and the announcement was updated on October 22, 2026.
Cost shapes the choice. For eligible customers, Microsoft’s unified Defender experience has offered a pay-as-you-go ingestion meter at $2.40 per GB for non-Microsoft data through more than 500 connectors since October 1, 2026, and regional pricing may vary. That figure is a useful yardstick for any per-gigabyte SIEM. A busy workstation can produce hundreds of megabytes of Sysmon data a day with a sloppy config, so the filtering work in Step 9 directly cuts your bill. Microsoft also began automatically moving managed Sentinel customers to the unified Defender portal in September 2026, as the October Defender monthly roundup describes. If you run Sentinel, check where your Sysmon data lands after that migration.
Here is a minimal WEF setup. On the collector server, run an elevated prompt and enable the collector service:
# On the collector
wecutil qc /q
# On each source endpoint
winrm quickconfig -q
wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824
The second wevtutil line raises the local Sysmon log cap to 1 GB so events survive a network outage. You then create a subscription on the collector that targets the Sysmon channel. Build the subscription XML in Event Viewer first, export it, and import it with wecutil cs subscription.xml so you can version-control it.
If you prefer an agent, this Winlogbeat input captures only the Sysmon channel:
winlogbeat.event_logs:
- name: Microsoft-Windows-Sysmon/Operational
ignore_older: 72h
output.logstash:
hosts: ["collector.example.internal:5044"]
Whichever route you pick, put the collector in a separate security zone with its own credentials. If the same admin password opens both the endpoint and the log server, ransomware operators will wipe both. Teams weighing managed detection options can compare vendors in our breakdown of CrowdStrike, Defender and SentinelOne, which all consume endpoint telemetry that Sysmon can complement.
Step 11: Test Your Detections With a Safe Simulation
A detection you never tested is a guess. This script mimics the visible symptoms of a ransomware run without encrypting anything. It creates dummy files, renames them to a fake encrypted extension, drops a ransom-note-style file, and lists shadow copies (list only, never delete). Run it on a test VM, never on a production box, and take a snapshot first.
$lab = "C:\SysmonLab"
New-Item -ItemType Directory -Path $lab -Force | Out-Null
# 1. Create 200 harmless files
1..200 | ForEach-Object { Set-Content -Path "$lab\doc$_.txt" -Value "test data $_" }
# 2. Rename them like a ransomware run would
Get-ChildItem "$lab\*.txt" | Rename-Item -NewName { $_.Name + ".locked" }
# 3. Drop a ransom-note-style file
Set-Content -Path "$lab\README_TO_RESTORE.txt" -Value "Sysmon detection test. No real threat."
# 4. Touch the shadow copy tooling in a read-only way
vssadmin list shadows | Out-Null
Write-Host "Simulation finished. Run Find-SysmonRansom.ps1 and check Event ID 11."
Now check what Sysmon caught:
Read nextQilin Ransomware Core Member, 28, Caught in Japan [2026]Cybersecurity · Oct 6
Get-WinEvent -FilterHashtable @{LogName="Microsoft-Windows-Sysmon/Operational"; Id=11} -MaxEvents 300 |
Where-Object { $_.Message -match 'Ransom Note|Encrypted Extension' } |
Group-Object { ([xml]$_.ToXml()).Event.EventData.Data |
Where-Object Name -eq 'RuleName' |
ForEach-Object '#text' } |
Select-Object Count, Name
You should see two groups, one tagged Ransom Note and one tagged Encrypted Extension, with a count near 200 for the extension rule. The vssadmin list shadows call is only a listing, so it will not match the delete shadows pattern. To test that pattern, run a harmless echo that contains the same text inside a VM, for example cmd /c echo vssadmin delete shadows, and confirm the hunting script flags the command line. If either check comes back empty, jump to the troubleshooting section below before you trust the setup.
Steps 12 and 13: Update Sysmon and Harden It Against Tampering
Step 12: Keep Sysmon and the config current. Microsoft shipped v15.2 in March 2026 and v15.22 in September 2026, so expect several releases a year. To move to a newer build, uninstall the old service and install the new binary with your existing config:
C:\Sysmon\Sysmon64.exe -u force
C:\NewSysmon\Sysmon64.exe -accepteula -i C:\Sysmon\sysmon-baseline.xml
# Reload only the config on a running install
C:\Sysmon\Sysmon64.exe -c C:\Sysmon\sysmon-baseline.xml
# Dump the config currently loaded, to prove what is active
C:\Sysmon\Sysmon64.exe -c
Check the active config after every change. Teams often edit the XML file on disk and forget that the running service still uses the old rules until someone reloads it.
Step 13: Protect the sensor. Attackers who know Sysmon exists will try to stop it. Three cheap measures raise the bar:
Rename the driver at install time. The -d option lets you pick a custom driver name, so a script that hunts for the default SysmonDrv name misses it.Alert on Event ID 4 and Event ID 16. Event 4 records Sysmon service state changes, and Event 16 records configuration changes. Either one outside a change window is a red flag.Lock down the files. Restrict write access to the Sysmon binary and config to administrators, and store the master copy of the config in version control.
Also watch for silence. A host that stops sending Sysmon events is more suspicious than a host that sends a few false positives. Build a simple alert that fires when a known endpoint has produced zero Sysmon events for 15 minutes.
Complete Working Project: One-Script Sysmon Deployment
Here is everything from Steps 1 through 13 folded into one script. It installs Sysmon if missing, reloads the config if Sysmon already runs, raises the log size, and then runs a self-test that proves events are flowing. Run it from an elevated session, or push it through your management tool of choice. It assumes the Sysmon binary and your tested config sit on a read-only network share.
#Requires -RunAsAdministrator
param(
[string]$Share="\\fileserver\secops\sysmon",
[string]$Work = 'C:\ProgramData\SysmonDeploy',
[long] $LogMax = 1073741824
)
$ErrorActionPreference="Stop"
New-Item -ItemType Directory -Path $Work -Force | Out-Null
# Pick the right binary for this CPU
$arch = $env:PROCESSOR_ARCHITECTURE
$exe = switch ($arch) { 'ARM64' { 'Sysmon64a.exe' } 'AMD64' { 'Sysmon64.exe' } default { 'Sysmon.exe' } }
Copy-Item "$Share\$exe" $Work -Force
Copy-Item "$Share\sysmon-baseline.xml" $Work -Force
# Refuse to run an unsigned or tampered binary
$sig = Get-AuthenticodeSignature "$Work\$exe"
if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notmatch 'Microsoft') {
throw "Signature check failed for $exe ($($sig.Status))"
}
$svcName = if ($exe -eq 'Sysmon.exe') { 'Sysmon' } else { 'Sysmon64' }
$svc = Get-Service -Name $svcName -ErrorAction SilentlyContinue
if ($svc) {
Write-Host "Sysmon present. Reloading configuration."
& "$Work\$exe" -c "$Work\sysmon-baseline.xml" | Out-Null
} else {
Write-Host "Installing Sysmon."
& "$Work\$exe" -accepteula -i "$Work\sysmon-baseline.xml" | Out-Null
}
# Make the local log survive a network outage
wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:$LogMax
# Self-test: launch a process and look for its event
Start-Process cmd.exe -ArgumentList '/c exit' -Wait
Start-Sleep -Seconds 3
$hit = Get-WinEvent -FilterHashtable @{
LogName="Microsoft-Windows-Sysmon/Operational"; Id=1; StartTime=(Get-Date).AddSeconds(-30)
} -ErrorAction SilentlyContinue | Select-Object -First 1
if ($hit) { Write-Host "OK: Sysmon is logging on $env:COMPUTERNAME" -ForegroundColor Green }
else { Write-Error "Sysmon installed but no events seen on $env:COMPUTERNAME" }
A successful run prints two short lines:
Installing Sysmon.
OK: Sysmon is logging on LAB-WIN11-01
Stage the rollout in rings. Push to five test machines first, wait 48 hours, review the noise report from Step 9, then widen to a pilot group and finally the whole fleet. Remote access paths deserve extra attention during the pilot, because attackers love exposed desktops. If you have not locked those down yet, follow our steps to secure Windows RDP against brute-force attacks alongside this project. Your port 3389 rule in Sysmon will then log the few connections that remain.
Common Pitfalls to Avoid
Most failed Sysmon projects share the same handful of mistakes. Check your plan against this list before you scale up.
Logging everything on day one. Enabling image-load events (ID 7) for all processes can generate more data than every other event type combined. Turn it on narrowly, for specific paths or processes, and only after you have watched your baseline volume.Pasting a config you never read. Public configs are excellent teaching material. They also contain exclusions for software you may not run and gaps for software you do. Read every exclusion, and delete the ones that do not apply.Excluding by file name alone. An exclusion for chrome.exe also excludes a malicious copy named chrome.exe in a temp folder. Match the full path, and add the signer or hash where the schema allows it.Leaving the log at its default size. A small log wraps within hours on a busy machine, and you lose the evidence you needed. Raise the cap and forward events off the box.Keeping logs only on the endpoint. Ransomware with admin rights can clear a local log. Forwarding is not optional for a serious deployment.Ignoring Event ID 255. This is Sysmon telling you it dropped events or hit an error. A quiet log with error events inside is worse than a noisy log, because it looks healthy.Testing in production. Run simulations on a VM with a snapshot. Even harmless test scripts can trip your endpoint protection and page an on-call engineer at 3 a.m.
One more habit pays off: write down why each exclusion exists, with a date and an owner. Six months later, nobody remembers why a rule hides a given process, and that forgotten rule becomes a blind spot. Phishing is still the most common way attackers reach the endpoint in the first place, so pair this work with staff training. Our guide on how to detect phishing emails is a good handout.
Troubleshooting: 10 Sysmon Problems and Fixes
When something breaks, work through these in order. Most problems come down to a config error, a permissions gap or a log that is too small.
The install fails with an access error. You are not elevated. Close the window, right-click PowerShell, choose Run as administrator, and run the command again. Remote sessions need an elevated token too.“Failed to parse configuration” or an XML error. A tag is unclosed, or a special character is unescaped. Replace any raw ampersand with & and any less-than sign inside a value with <. Run the PowerShell XML check from Step 4 to find the bad line.The schema version does not match. Run Sysmon64.exe -s, read the schema version your build supports, and update the attribute in your file. Configs written for much older builds sometimes use elements the current schema renamed.The service runs but the log is empty. Your include rules are too strict, or every event type is in include mode with no matching rule. Add a broad ProcessCreate exclude group, launch Notepad, and check again. Also confirm you are reading the Sysmon Operational channel, not the Application log.You enabled built-in Sysmon on Windows 11 26H2 and see no events. Microsoft documents the built-in feature as off by default, and it needs a configuration file before it records anything useful. Turn the feature on, load your XML, then repeat the Step 6 test.High CPU or disk use. Usually image-load logging (ID 7) or an unfiltered network rule. Use the Step 9 query to find the noisiest program, then narrow the rule. The v15.2 update improved queue handling under heavy load, so make sure you run a current build.The log fills in hours. Raise the cap with wevtutil sl, add exclusions for verified noise, and forward events to a collector so the local copy is a buffer, not the only copy.Event ID 255 appears. Open the event and read the description. Common causes are dropped events under load and a config that failed to apply. Fix the config, reload it with -c, and check that the error stops.Nothing arrives at the collector. Test the path in layers. Confirm WinRM answers on the endpoint, the collector service is running, and the subscription lists the host as active. For agent-based shipping, check the agent’s own log for connection errors and clock drift.A flagged file needs a deeper look. Sysmon gives you the SHA256. Look the hash up in your threat intelligence tool, then write a custom detection. Our walkthrough on how to write YARA rules for malware detection shows how to turn a sample into a reusable scan rule.
If a problem survives all ten checks, uninstall with Sysmon64.exe -u force, reboot, and reinstall from a freshly verified download. That clears most driver and service corruption, including cases where another security product blocked the driver load the first time.
Advanced Tips for Sysmon Power Users
Once the baseline runs cleanly for a few weeks, these upgrades add real detection value.
Add targeted image-load rules. Instead of logging every DLL, log loads of specific modules that attackers abuse, such as credential-related libraries loaded by unusual processes. Keep the rule list short and review hit counts monthly.Archive deleted files. Event ID 23 can archive files that processes delete, which lets you recover payloads or documents after an incident. It consumes disk quickly, so limit it to specific folders and set a clear retention limit.Use file-blocking events carefully. Current builds include events that can block certain executable file creation based on your rules. Run them in audit mode first and review the hits before you enforce anything.Detect credential theft chains. Combine your LSASS access rule (Event ID 10) with the process creation log to see which parent launched the dumper. Attacks that abuse Windows authentication, such as the technique covered in our guide to detecting and stopping Kerberoasting, leave traces in both places.Translate rules into Sigma. Keep your detection logic in a portable format so you can move between SIEM products without rewriting everything.Pair it with an EDR. Microsoft lists Defender for Endpoint Plan 1, Defender for Endpoint Plan 2 and Defender for Business as its current endpoint options. Sysmon fills gaps those products do not expose, such as custom command-line tagging, and it costs nothing in licensing.Check the Linux build. Microsoft’s Sysinternals blog has listed activity on Linux versions of Sysmon, ProcDump and Procmon. If you run mixed fleets, evaluate it for servers, and treat its config format as separate from the Windows one.
The takeaway: a modest, well-tuned Sysmon config beats a giant one nobody understands. For more detection and response guides, browse the cybersecurity section and pick the next control to add.
Frequently Asked Questions About Sysmon
Is Sysmon free? Microsoft’s pages list no separate price or paid plan for Sysmon. It is distributed through the Sysinternals downloads and the Microsoft Store as part of the Sysinternals Suite. Your real costs are engineering time, storage and any SIEM ingestion fees.
What is the latest Sysmon version? As of October 22, 2026, Microsoft’s Sysinternals index lists Sysmon v15.22, dated September 10, 2026. Check the official page before you deploy, because releases arrive several times a year.
Does Windows 11 include Sysmon now? Yes, in version 26H2. Microsoft documented built-in Sysmon on September 29, 2026. It is disabled by default, accepts custom configuration files and writes to the Windows Event Log. Microsoft also describes it as an optional feature on Windows Server 2025. Older supported Windows versions still need the standalone download.
Can Sysmon stop ransomware? Not by itself. Sysmon records and reports. It does not quarantine files or kill processes in a standard setup. Its value is detection and investigation, so connect it to alerting and keep backups and patching in place.
Will Sysmon slow down my computer? A tuned config has a small footprint on most machines. Heavy slowdowns almost always trace back to unfiltered image-load or network logging. Measure with the noise query in Step 9 and trim from there.
Where are Sysmon logs stored? In the Microsoft-Windows-Sysmon/Operational channel. In Event Viewer, open Applications and Services Logs, then Microsoft, then Windows, then Sysmon, then Operational. Forward them off the machine so an attacker cannot erase the only copy.
Which Windows versions does Sysmon support? Microsoft’s page notes it is not available on Windows 7 and earlier, and lists Windows Server 2019 and higher for servers. Use the ARM64 package on ARM devices and the Nano Server package where needed.
How often should I update the config? Review it monthly for the first quarter, then quarterly. Reload with the -c flag each time and confirm the active rules by running Sysmon64.exe -c with no file argument.More on this topicCybersecurityCloud ComputingSoftwareAI & Machine LearningTrending noweMudhra’s CA Keys Cracked: One Was the Number 4 [2026]SBI Data Leak: 3,897 Records Hit Dark Web [2026]eMudhra Exits TLS Business After 8 Weak CA Keys [2026]Best Smartphones of 2026, Ranked: $278 to $1,999 [2026]Samsung P9 Express for Switch 2 Drops to $59.99 [2026]
Elias VirtanenCybersecurity AnalystElias Virtanen is the Cybersecurity Analyst at Tech Insider, bringing hands-on expertise from his background in penetration testing and security consulting. He previously worked as a security researcher at F-Secure in Helsinki, where he focused on threat intelligence and vulnerability disclosure. Elias covers ransomware trends, zero-trust architecture, and the evolving regulatory landscape including NIS2 and the EU Cyber Resilience Act. He holds a CISSP certification and an MSc in Information Security from Aalto University.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.
One email a week. No spam, unsubscribe anytime.
——————————————————–
Click Here For The Original Source.
