CmdID

CmdID / Commands

sysmon

System Monitor (Sysmon) is a Windows system service and device driver that you install on a system. Windows commands reference

On Windows 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

System Monitor (Sysmon) is a Windows system service and device driver that you install on a system. It stays resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time. TIP: Starting February 2026, Sysmon is available as a built-in optional feature for Windows 11. To learn more, see Sysmon overview. Looking for the Sysinternals standalone documentation? See Sysinternals Sysmon. - Event logs are stored in Applications and Services Logs/Microsoft/Windows/Sysmon/Operational log. - The install or uninstall options don't require a reboot. - To reset the configuration to default settings, use sysmon -c --.

sysmon [-i [<configfile>]] [-c [<configfile>]] [-m] [-s] [-u [force]] [-accepteula]

To install Sysmon with default settings, run the following command

sysmon -accepteula -iIdentify
-accepteulaAutomatically accepts the End User License Agreement (EULA) on installation. Windows commands reference
-iInstalls the service and driver. Windows commands reference

Trips 1 Sigma rule: lowPotential Execution of Sysinternals Tools by Markus Neis

To install Sysmon with a configuration file, run the following command

sysmon -accepteula -i c:\windows\config.xmlIdentify
-accepteulaAutomatically accepts the End User License Agreement (EULA) on installation. Windows commands reference
-iInstalls the service and driver. Windows commands reference

Trips 1 Sigma rule: lowPotential Execution of Sysinternals Tools by Markus Neis

To dump the current configuration, run the following command

sysmon -cIdentify
-cUpdates the configuration of an installed Sysmon driver, or dumps the current configuration if no other argument is provided. Windows commands reference

Trips 1 Sigma rule: mediumSysmon Configuration Update by Nasreddine Bencherchali (Nextron Systems)

To reset the configuration to default settings, run the following command

sysmon -c --Identify
-cUpdates the configuration of an installed Sysmon driver, or dumps the current configuration if no other argument is provided. Windows commands reference

Trips 1 Sigma rule: mediumSysmon Configuration Update by Nasreddine Bencherchali (Nextron Systems)

To reconfigure Sysmon with a configuration file, run the following command

sysmon -c c:\windows\config.xmlIdentify
-cUpdates the configuration of an installed Sysmon driver, or dumps the current configuration if no other argument is provided. Windows commands reference

Trips 1 Sigma rule: mediumSysmon Configuration Update by Nasreddine Bencherchali (Nextron Systems)

To display the configuration schema, run the following command

sysmon -sIdentify
-sPrints the configuration schema definition of the specified version. Windows commands reference

To display the configuration schema for a specific version, run the following command

sysmon -s 4.50Identify
-sPrints the configuration schema definition of the specified version. Windows commands reference

To display all configuration schema versions, run the following command

sysmon -s allIdentify
-sPrints the configuration schema definition of the specified version. Windows commands reference

To uninstall Sysmon, run the following command

sysmon -uIdentify
-uUninstalls the service and driver. Windows commands reference

Trips 1 Sigma rule: highUninstall Sysinternals Sysmon by frack113

-i [<configfile>]Installs the service and driver. Optionally includes a configuration file.
-c [<configfile>]Updates the configuration of an installed Sysmon driver, or dumps the current configuration if no other argument is provided. Optionally includes a configuration file.
-mInstalls the event manifest. The service install implicitly does this action.
-s [<schemaversion>]Prints the configuration schema definition of the specified version. Specify all to dump all schema versions. The default is latest.
-u [force]Uninstalls the service and driver. Using -u force causes uninstall to proceed even when some components aren't installed.
-accepteulaAutomatically accepts the End User License Agreement (EULA) on installation.
-? configDisplays more information on configuration files.

What detects it

Sigma process creation rules that name sysmon
highSuspicious Sysmon as Execution ParentFlorian Roth (Nextron Systems), Tim Shelton (fp werfault)
highUninstall Sysinternals Sysmonfrack113
mediumPotential Binary Impersonating Sysinternals Toolsfrack113, Swachchhanda Shrawan Poudel (Nextron Systems)
mediumSysmon Configuration UpdateNasreddine Bencherchali (Nextron Systems)