Overview
The Sysmon command retrieves Sysmon (System Monitor) configuration from the registry. Sysmon is a powerful Windows system service that logs detailed system activity including process creation, network connections, and file modifications. Understanding Sysmon configuration reveals what activities are being monitored and logged.Syntax
Remote Execution
Output
Returns Sysmon configuration:- Sysmon installation status
- Sysmon version
- Configuration file hash
- Configured event IDs
- Filtering rules
- Network monitoring status
- Process access monitoring
Use Cases
- Red Team
- Blue Team
- Determine if Sysmon is deployed
- Identify monitored activities
- Understand detection capabilities
- Plan evasion strategies
- Assess logging granularity
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
- Registry Access: Queries
HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv - WMI Activity: Remote execution generates WMI events
- Sysmon Event 12/13: Registry access may be logged by Sysmon itself
Related Commands
- AuditPolicies - Windows audit policies
- PowerShell - PowerShell logging configuration
- WindowsEventForwarding - Event forwarding
- InterestingProcesses - Security products