Manual Sysmon Installation

This page describes the procedure for manually installing and configuring Sysmon on the machines to be monitored.

Sysmon, short for System Monitor, is a tool developed by Microsoft that provides detailed logging of activities performed on Windows systems.

The procedure must be performed locally through a PowerShell session started with administrator privileges. This method can also be used on RT clients.

Download and Installation

Download

The Sysmon package can be downloaded from the Microsoft Learn portal.

Once the download is complete, extract all the files contained in the archive to a local folder, for example:

"C:\Download\Sysmon\"

Creating the configuration file

Open a PowerShell window with administrator privileges and run the following command:

$SysmonDir = 'C:\Download\Sysmon'

$SysmonExe = Join-Path $SysmonDir 'Sysmon64.exe'

$ConfigFile = Join-Path $SysmonDir 'sysmon-businesslog.xml'

if (-not (Test-Path -LiteralPath $SysmonExe)) {

throw "Eseguibile Sysmon non trovato: $SysmonExe"

}

Then run the following command to create the configuration file used by BusinessLog:

@'
<Sysmon schemaversion="4.90">
<HashAlgorithms>SHA256</HashAlgorithms>
<CheckRevocation>true</CheckRevocation>

<ProcessCreate onmatch="exclude" />

<ProcessTerminate onmatch="exclude" />

<DriverLoad onmatch="exclude" />

<CreateRemoteThread onmatch="exclude" />

<RawAccessRead onmatch="exclude" />

<WmiEvent onmatch="exclude" />

<ProcessTampering onmatch="exclude" />

<FileExecutableDetected onmatch="exclude" />

</EventFiltering>
</Sysmon>
'@ | Set-Content -LiteralPath $ConfigFile -Encoding utf8

Write-Host "Configurazione creata: $ConfigFile"

The configuration enables the logging of the following events:

ID 1 – Process creation;
ID 5 – Process termination;
ID 6 – Driver loading;
ID 8 – Remote thread creation;
ID 9 – Direct disk access;
IDs 19, 20 and 21 – WMI events;
ID 25 – Process tampering;
ID 29 – Detection of new executable files.

Installing Sysmon

After creating the XML configuration file, run:

& $SysmonExe -accepteula -i $ConfigFile

if ($LASTEXITCODE -ne 0) {
throw "Installazione di Sysmon fallita. Exit code: $LASTEXITCODE"
}

The command automatically accepts the licence terms, installs the Sysmon service, and applies the configuration prepared for BusinessLog.

Updating an Existing Configuration

If Sysmon is already installed and configured on the machine, there is no need to reinstall the service.

To apply the new configuration, run:

& $SysmonExe -c $ConfigFile

if ($LASTEXITCODE -ne 0) {
throw "Aggiornamento della configurazione Sysmon fallito. Exit code: $LASTEXITCODE"
}

Once the operation is complete, verify that the configuration has been updated correctly.

Enabling the event log

To enable the Sysmon operational log, run:

$Channel = 'Microsoft-Windows-Sysmon/Operational'

wevtutil sl $Channel /e:true

The events logged by Sysmon will be available in the following log:

Microsoft-Windows-Sysmon/Operational

Verifying the installation

To verify that the Sysmon service has been installed correctly, run:

Get-Service -Name 'Sysmon*'

To check that Sysmon is logging events, run:

Get-WinEvent `

-LogName 'Microsoft-Windows-Sysmon/Operational' `

-MaxEvents 10 |

Select-Object TimeCreated, Id, ProviderName, Message

The command displays the ten most recent logged events, including the date and time, event ID, source, and description.

BusinessLog Automatic Script

As an alternative to the manual procedure, BusinessLog provides the following script:

ConfiguraSysmonBusinessLog.ps1

The script is located in the Sysmon subfolder distributed with the BusinessLog setup and already contains all the logic described on this page.

The script automates:

checking that the Sysmon executable is present;
creating the XML configuration file;
installing or updating Sysmon;
enabling the monitored events;
enabling the event log.

NOTE: Manual installation and local script execution are also supported on RT clients.