And, as you see, there’s event consumer, event filter, ConsumerToFilter activity, and so on. Within the new Sysmon, you’ve got a possibility here to monitor WMI event filter. Probably you will not find that information quickly on the Internet, but that’s fine because here you are able to see what kind of stuff is added.

This is what we’re going to have logged in the event log: file creation time change, of course, process tracking, process creation, and process termination, network connection detected, driver loaded and things like that.Įvery single time there is a new Sysmon version released, don’t worry.

This is the newest Sysmon 6.10 and over here you can see the templates that define us different types of approach to logging. It’s important to check how the manifest looks like, and the reason why it’s like this is that we need to verify what kind of possibilities we’ve got. For example, if you go to Sysmon executable… Let’s open on this one… in the resource hacker. In order to be able to build a Sysmon configuration file, you need to first learn how to check what Sysmon has to offer.

Process monitor filter file accesss