Follow Sysmon writes to its own event log channel. In Event Viewer that’s Applications and Services Logs → Microsoft → Windows → Sysmon → Operational. On the command line it’s Microsoft-Windows-Sysmon/Operational, and on disk C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx. To export it, run this from an elevated prompt:
wevtutil epl "Microsoft-Windows-Sysmon/Operational" C:\logs\sysmon.evtx
If the channel doesn’t exist, Sysmon isn’t installed. On most machines it’s still a separate Sysinternals tool that someone has to deploy.
Sysmon is the closest thing Windows has to a flight recorder. It captures process trees with full command lines and hashes, network connections per process, DNS queries, and file and registry changes. Prime Core has 12074 sigma rules written for Sysmon data, mapped to 645 MITRE ATT&CK techniques. Here’s how to check that it’s running, export what it recorded, and investigate it in LogTotal.
Before you start
Is it running? Check the service:
sc query sysmon64
On 32-bit systems the service is called sysmon. You want STATE: RUNNING.
What is it recording? Sysmon logs only what its configuration tells it to. Without a config file, you get a small default set built around process creation. Most of the value comes from a tuned config, such as SwiftOnSecurity’s or Olaf Hartong’s sysmon-modular. To see the current one, run sysmon64 -c (the binary lives in C:\Windows). Save that output next to your export. Whoever analyzes the file will ask why there are no network events, and the config answers that.
How far back does it go? Sysmon is chatty, and its channel has a size limit like any other log. Run wevtutil gl “Microsoft-Windows-Sysmon/Operational” and check maxSize. On a busy server, a default-sized log can cover surprisingly little time.
You need an elevated prompt to export.
Export the log
In Event Viewer, right-click Operational under Sysmon and choose Save All Events As…, keeping the .evtx type. From the command line, you can filter while you export:
:: last 24 hours
wevtutil epl "Microsoft-Windows-Sysmon/Operational" C:\logs\sysmon_24h.evtx /q:"*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]"
:: process creation only
wevtutil epl "Microsoft-Windows-Sysmon/Operational" C:\logs\sysmon_proc.evtx /q:"*[System[(EventID=1)]]"
What to look for
| Event ID | What it records | Why you care |
|---|---|---|
| 1 | Process creation, with command line, hashes and parent | The backbone of almost every investigation |
| 3 | Network connection by process | Often filtered out in configs because of volume |
| 10 | One process opening another | Access to lsass.exe is the classic credential-dumping signal (T1003.001) |
| 11 | File created | Dropped payloads, staged archives |
| 12,13,14 | Registry changes | Run keys and other persistence |
| 22 | DNS query by process | Which process looked up that domain |
| 4,16 | Sysmon service state and config changed | An attacker turning Sysmon off or neutering its config |
If the events simply stop at some point, look for event 16 or 4 just before the gap. Then check the System log for the Sysmon service being stopped.
Upload and review in LogTotal
LogTotal reads EVTX natively, so there’s nothing to convert. One thing to know first: LogTotal doesn’t sanitize EVTX files yet. Treat an EVTX upload as handing over the raw file. Use it freely for test machines, but for production hosts, get a yes from whoever owns data handling first.
- Upload. Open logtotal.com and drop in the file.
- Review. [PROOF: what the results screen shows for Sysmon data, and how findings map to rules and ATT&CK techniques]
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| The specified channel could not be found | Sysmon isn’t installed | Check with sc query sysmon64 |
| Channel exists but holds almost nothing | No config, or a config that filters nearly everything | Check sysmon64 -c |
| Process events but no network events | The config excludes event 3, which is common | By design; check the config before assuming nothing happened |
| Events stop at some point | Sysmon stopped, uninstalled or reconfigured | Look for events 4 and 16, and the System log |
| Only the last few hours are there | The log is full and overwriting | Check maxSize; for history, use your SIEM |
| Access is denied | Prompt isn’t elevated | Run as administrator |
FAQ
Is Sysmon installed by default?
On most machines, no. It’s a free Sysinternals download that you deploy and configure yourself. Microsoft has announced built-in Sysmon for newer Windows releases, so check what your builds actually ship with.
Does the analyst need my Sysmon config?
Not to read the events, but it explains the gaps. Send the sysmon64 -c output along with the export.
Is there Sysmon for Linux?
Yes. It writes to syslog instead of an EVTX channel; we’ll cover it in a separate guide.
