thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Sysmon

System Monitor, a free Microsoft Sysinternals tool that logs detailed process, network, file and registry activity to the Windows event log.

Definition

Sysmon events include ID 1 process creation with hashes, ID 3 network connection, ID 7 image loaded, ID 8 CreateRemoteThread, ID 10 process access (such as LSASS), ID 11 file create, ID 13 registry value set and ID 22 DNS query. It is configured via XML, with community configurations from SwiftOnSecurity and Olaf Hartong.

Example

Sysmon Event ID 10 showing an unknown process opening lsass.exe with read access.

Exam tip

Sysmon Event ID 1 = process creation; 3 = network; 10 = process access (credential dumping).

Related terms