Update an existing Sysmon configuration
masterTo apply changes from a new configuration file to an already running Sysmon instance, run sysmon.exe with administrator rights using the -c flag.
sysmon.exe -c sysmonconfig-export.xmlswiftonsecurity Sysmon Configuration
repository·master·Indexed 26 days ago
https://github.com/swiftonsecurity/sysmon-configA Microsoft Sysinternals Sysmon configuration template for system change monitoring in Windows environments. Includes instructions for installation, updating, and uninstalling using sysmon.exe, as well as guidance on customizing the sysmonconfig-export.xml file and optimizing software installation paths.
What's inside swiftonsecurity-sysmon-config
Install the Sysmon configuration
masterTo install the Sysmon configuration, run the
sysmon.exeexecutable with administrator rights using the-accepteulaand-iflags, pointing to thesysmonconfig-export.xmlfile.sysmon.exe -accepteula -i sysmonconfig-export.xmlConfigure software installation paths for optimal monitoring
masterThis configuration is designed with the expectation that software is installed system-wide rather than in theC:\Usersfolder. To ensure effective monitoring and avoid excessive noise from user-directory-based installations, install system-wide versions of software (e.g., Google Chrome) whenever possible. Refer to the configuration file for specific instructions on path monitoring.Uninstall Sysmon
masterTo remove Sysmon from the system, run
sysmon.exewith administrator rights using the-uflag.sysmon.exe -uCustomize the Sysmon configuration for your environment
masterBefore wide deployment, you must test and observe the configuration in your specific environment. A critical customization step is excluding actions from your antivirus software to prevent logs from being flooded with irrelevant information. Thesysmonconfig-export.xmlfile is highly commented to assist with this process.