# Sysmon

<figure><img src="https://3194248079-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRDc44tPNsBhsf--dD%2Fuploads%2FEO1NRQ43eX9pLmDdsjm2%2Fimage.png?alt=media&#x26;token=8577e789-8209-4c06-a5d2-5bd8244812e9" alt=""><figcaption></figcaption></figure>

System Monitor (Sysmon) is a Windows system service and device driver that remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about:

* process creations
* network connections
* changes to files

Events within Sysmon are stored in `Applications and Services Logs/Microsoft/Windows/Sysmon/Operational.`

Here is a list of some important Sysmon events:

<table><thead><tr><th width="102.509765625">Event ID</th><th>Event Description</th></tr></thead><tbody><tr><td>1</td><td>Process Creation</td></tr><tr><td>3</td><td>Network Connection</td></tr><tr><td>7</td><td>Image Loaded</td></tr><tr><td>8</td><td>CreateRemoteThread</td></tr><tr><td>11</td><td>File Created</td></tr><tr><td>12/13/14</td><td>Registry Event</td></tr><tr><td>15</td><td>FileCreateStreamHash</td></tr><tr><td>22</td><td>DNS Event</td></tr></tbody></table>
