Sysmon

Sysmon is a command-line interface (CLI) tool that monitors and logs system activity. It works as a Windows system service and also as a device driver that logs system events (network connections, changes to information regarding created files, etc.).

Capabilities Overview:

• Uploads hash process image files using SHA1 (default), MD5, SHA256 or IMPHASH.
• Batch processing.
• Includes the GUID process in the event creation process to allow event correlation even if Windows reuses the ID process.
• Include session GUIDs in individual events, to allow event correlation on the same login session.