Sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. Sysmon does not provide analysis of the events it generates, nor does it attempt to protect or hide itself from attackers. It runs in the background all the time and writes events to the event log.
Let’s talk about the Guide to Sysinternals Sysmon’s suspicious activity in this article. This guide will help you explore and handle these events appropriately.
Moti Bani gives step-by-step instructions of this tool. The concept of Microsoft Cybersecurity consists of three pillars: protection, detection and response. This blog focuses on the last two. We hope this information will be useful to you.
