Download Microsoft Sysmon for Windows PC v15.22 for Windows PC
Sysmon is Microsoft's free Sysinternals service that logs process creation, network connections, file changes and more into the Windows Event Log —...
Technical Specifications & System Requirements
Software notes
Features
- Records the telemetry incident responders actually need — process trees with command lines and hashes, network connections, DNS queries, image loads, and injection events.
- Free from Microsoft Sysinternals, signed, lightweight, and hardened: it runs as a protected service and driver that resists tampering and survives reboots.
- XML configuration gives precise control over what is logged, and mature community configs (SwiftOnSecurity, sysmon-modular) provide proven starting points.
- Writes to the standard Windows Event Log, so it feeds any SIEM, Splunk, Sentinel or Elastic stack with no extra agent.
- The de-facto standard for Windows threat hunting — detection rules (Sigma) and documentation across the industry assume Sysmon data.
Considerations
- Command-line only with no GUI and no default configuration — first-time users must fetch and understand a community config before it is useful.
- Poorly tuned configs generate enormous event volume that can overwhelm local logs and SIEM ingestion budgets.
- It is a logging tool, not protection: it detects and records but blocks nothing, so it complements rather than replaces endpoint security.
About & Overview: Microsoft Sysmon for Windows PC
System Monitor (Sysmon) is a free Windows system service and driver from Microsoft's Sysinternals team that, once installed, survives reboots and records detailed security telemetry into the Windows Event Log: process creation with full command lines and hashes, network connections, driver and DLL loads, file creation time changes, DNS queries, process injection, registry and WMI events, and named-pipe activity. It is configured through an XML file — community configurations such as SwiftOnSecurity's give sensible coverage out of the box — and is the standard data source for Windows threat hunting, EDR tuning, and incident response on both endpoints and servers.
How to Install & Verify Microsoft Sysmon for Windows PC
Download Sysmon from the official Microsoft Sysinternals link on this page and extract the ZIP.
Open an elevated terminal in the folder and run: Sysmon64.exe -accepteula -i config.xml — using a trusted community config (e.g. SwiftOnSecurity's) or your own.
Events appear under Applications and Services Logs > Microsoft > Windows > Sysmon > Operational. Update the config any time with Sysmon64.exe -c config.xml.
Related Windows PC Software & Alternatives
Frequently Asked Questions & Verification Guide
Is Sysmon free?
Yes. Sysmon is a free Sysinternals utility from Microsoft, usable on personal and corporate systems under the Sysinternals license.
Does Sysmon come with a configuration file?
No — you supply an XML config at install time. Most users start with the well-maintained SwiftOnSecurity or sysmon-modular configurations from GitHub and adjust the rules to their environment.
How do I install Sysmon on Windows 11?
Extract the ZIP, open an elevated terminal, and run Sysmon64.exe -accepteula -i config.xml. Uninstall with Sysmon64.exe -u. This page's download is the official package from download.sysinternals.com.
Does Sysmon slow down the PC?
Impact is minimal on modern hardware with a sensible config. Extremely verbose configs (logging every file create on a busy server) can add overhead, which is what the exclude rules are for.
Can Sysmon replace my antivirus?
No. Sysmon only observes and logs activity for detection and forensics; it does not block or remove threats. Pair it with your existing endpoint protection.