Sysmon

Sysmon uses an XML configuration file with two main sections: HashAlgorithms and EventFiltering.

• The HashAlgorithms section defines the hash algorithms to be used.

• The EventFiltering section specifies events to monitor or exclude.

To control event logging, use include statements to monitor specific events and exclude statements to ignore them.

Event filtering entries

ID	Tag	Event
1	ProcessCreate	Process Create
2	FileCreateTime	File creation time
3	NetworkConnect	Network connection detected
4	n/a	Sysmon service state change (cannot be filtered)
5	ProcessTerminate	Process terminated
6	DriverLoad	Driver Loaded
7	ImageLoad	Image loaded
8	CreateRemoteThread	CreateRemoteThread detected
9	RawAccessRead	RawAccessRead detected
10	ProcessAccess	Process accessed
11	FileCreate	File created
12	RegistryEvent	Registry object added or deleted
13	RegistryEvent	Registry value set
14	RegistryEvent	Registry object renamed
15	FileCreateStreamHash	File stream created
16	n/a	Sysmon configuration change (cannot be filtered)
17	PipeEvent	Named pipe created
18	PipeEvent	Named pipe connected
19	WmiEvent	WMI filter
20	WmiEvent	WMI consumer
21	WmiEvent	WMI consumer filter
22	DNSQuery	DNS query
23	FileDelete	File Delete archived
24	ClipboardChange	New content in the clipboard
25	ProcessTampering	Process image change
26	FileDeleteDetected	File Delete logged
27	FileBlockExecutable	File Block Executable
28	FileBlockShredding	File Block Shredding
29	FileExecutableDetected	File Executable Detected

---

"condition" type and features

Condition	Description
is	Default, values are equals
is any	The field is one of the ; delimited values
is not	Values are different
contains	The field contains this value
contains any	The field contains any of the ; delimited values
contains all	The field contains all of the ; delimited values
excludes	The field does not contain this value
excludes any	The field does not contain one or more of the ; delimited values
excludes all	The field does not contain any of the ; delimited values
begin with	The field begins with this value
end with	The field ends with this value
not begin with	The field does not begin with this value
not end with	The field does not end with this value
less than	Lexicographical comparison is less than zero
more than	Lexicographical comparison is more than zero
image	Match an image path (full path or only image name). For example: lsass.exe will match c:\windows\system32\lsass.exe