- File Path:
- Description: System activity monitor
System Monitor v7.02 - System activity monitor Copyright (C) 2014-2018 Mark Russinovich and Thomas Garnier Sysinternals - www.sysinternals.com
Usage: Install: C:\WINDOWS\Sysmon64.exe -i [<configfile>] [-h <[sha1|md5|sha256|imphash|*],...>] [-n [<process,...>]] [-l [<process,...>] Configure: C:\WINDOWS\Sysmon64.exe -c [<configfile>] [--|[-h <[sha1|md5|sha256|imphash|*],...>] [-n [<process,...>]] [-l [<process,...>]]] Uninstall: C:\WINDOWS\Sysmon64.exe -u -c Update configuration of an installed Sysmon driver or dump the current configuration if no other argument is provided. Optionally take a configuration file. -d Specify the name of the installed device driver image. Configuration entry: DriverName. The service image and service name will be the same name of the Sysmon.exe executable image. -h Specify the hash algorithms used for image identification (default is SHA1). It supports multiple algorithms at the same time. Configuration entry: HashAlgorithms. -i Install service and driver. Optionally take a configuration file. -l Log loading of modules. Optionally take a list of processes to track. -m Install the event manifest (done on service install as well). -n Log network connections. Optionally take a list of processes to track. -r Check for signature certificate revocation. Configuration entry: CheckRevocation. -s Print configuration schema definition of the specified version. Specify 'all' to dump all schema versions (default is latest). -u Uninstall service and driver. The service logs events immediately and the driver installs as a boot-start driver to capture activity from early in the boot that the service will write to the event log when it starts. On Vista and higher, events are stored in "Applications and Services Logs/Microsoft/Windows/Sysmon/Operational". On older systems, events are written to the System event log. If you need more information on configuration files, use the '-? config' command. More examples are available on the Sysinternals website. Specify -accepteula to automatically accept the EULA on installation, otherwise you will be interactively prompted to accept it. Neither install nor uninstall requires a reboot.
- Status: Signature verified.
- Issuer: CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Original Filename:
- Product Name: Sysinternals Sysmon
- Company Name: Sysinternals - www.sysinternals.com
- File Version: 7.02
- Product Version: 7.02
- Language: English (United States)
- Legal Copyright: Copyright (C) 2014-2018 Mark Russinovich and Thomas Garnier
The following table contains possible examples of
Sysmon64.exe being misused. While
Sysmon64.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
MIT License. Copyright (c) 2020-2021 Strontic.