Add it to your Download Basket!
Add it to your Watch List!
What's new in Sysmon 2.0:
- This major update to Sysmon, a service that records process activity to the Windows event log for use by incident detection and forensic analysis, includes driver load and image load events with signature information, configurable hashing algorithm reporting, flexible filters for including and excluding events, and support for supplying configuration via a configuration file instead of the command line.
malware send us
- LICENSE TYPE:
- FILE SIZE:
- 602 KB
- OUR RATING:
- DEVELOPED BY:
- USER RATING:
- C: \ System \ System Info
The main purpose of the program resides in helping you monitor and capture your system activity to the Windows event log, so you can determine if there is anything out of place on your computer.
Purpose and functionality
Sysmon works as a Windows service as well as a device driver, tracking various actions on your system, for instance the network connections, changes to the files’ creation times, process creation and other relevant details.
However, the utility does not provide interpretation abilities, so the gathered information will need to be analyzed separately, by you.
Install and configure your system monitoring service
In order to install the tool on your PC, you need to open a CMD window and drop the EXE file onto it, after which you can type the ' -i [-h [sha1|md5|sha256]] [-n]’ command and hit Enter, allowing it to go through all its paces.
Once complete, you can begin configuring Sysmon, using a series of arguments, depending on what you wish to do with it. Some of its capabilities include recording the hash of process image files in MD5, SHA256 or SHA1, the last of which is used by default.
Moreover, it can log network connection details, namely the source process, the IP address, the hostnames and the port numbers. By analyzing the gathered data, you can determine whether anything suspicious occurs on your computer, being able to figure out if there are any intruders on your network.
A reliable instrument for tracking and logging your system’s activity
To sum it up, Sysmon is a comprehensive and efficient CMD tool, aimed mainly at advanced individuals, enabling you to monitor system activity and identify the occurrence of anomalous behavior.
Sysmon was reviewed by Marina Dan, last updated on January 20th, 2015
Runs on: Windows XP / Vista / 7 / 8 / 8 64 bit