trustedsec-SysmonCommunityGuide/sysmon.md

Table of Contents

• What is Sysmon

• The Sysmon Driver

• Install and Configuration

• Sysmon Events

  • Process Events

    • Process Creation

    • Process Termination

    • Process Access

  • File Events

    • File Create

    • File Create Time Change

    • File Stream Creation Hash

  • Named Pipes

  • Driver Loading

  • Registry Actions

  • Image Loading

  • Network Connections

  • Create Remote Thread

  • Raw Access Read

  • DNS Query

  • WMI Events