# Install & configure Sysmon for deep Windows event logging

_System Monitor_ (_Sysmon_) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time.

Let's start by installing Sysmon from the following link: [Sysmon Download](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)

We also need to download the Sysmon configuration file from the following URL: [Sysmon Modular Configuration](https://github.com/olafhartong/sysmon-modular/blob/master/sysmonconfig.xml).

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F7GGjizKuVn6yMSnRSfjI%2FScreenshot(21).png?alt=media&#x26;token=dbd70c9d-41ae-4e64-a68b-34e956098c25" alt=""><figcaption></figcaption></figure>

Next, let's extract the Sysmon compressed folder and place the Sysmon configuration file in the same directory as Sysmon.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FT3Ss0NqTOOMWVBKQ8Plf%2FScreenshot(22).png?alt=media&#x26;token=fb11be98-c4c3-4779-9d2e-ca12cb311baa" alt=""><figcaption></figcaption></figure>

Next, we need to open PowerShell with administrative privileges to configure Sysmon.

```powershell
.\Sysmon64.exe -i .\sysmonconfig.xml
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FXKorLoI8AdkoKzY0kGka%2FScreenshot(23).png?alt=media&#x26;token=4c2941ea-1ac0-4903-9050-6e38d256166a" alt=""><figcaption></figcaption></figure>

Let's verify whether Sysmon is installed on the system.

```powershell
Get-Service Sysmon64
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F2wXUORG5giN7LeOjPvBS%2FScreenshot(24).png?alt=media&#x26;token=0c1b856b-fd84-4e78-ae29-4465ffa8426c" alt=""><figcaption></figcaption></figure>

We can also verify this using the Event Viewer.

```
Applications and Services Logs -> Microsoft -> Windows -> Sysmon
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fg4qzjp44eUMqxE6MEiQC%2FScreenshot(25).png?alt=media&#x26;token=b42d0607-9034-4c7a-99bf-d40ff3fd6e6f" alt=""><figcaption></figcaption></figure>
