TryHackMe | Sysmon

Sysmon, a tool used to monitor and log events on Windows, is commonly used by enterprises as part of their monitoring and logging solutions. Part of the Windows Sysinternals package, Sysmon is similar to Windows Event Logs with further detail and granular control. This room uses a modified version of the Blue and Ice boxes, as well as Sysmon logs from the Hololive network lab. Before completing this room we recommend completing the Windows Event Log room. It is also recommended to complete the Blue and Ice rooms to get an understanding of vulnerabilities present however is not required to continue. Sysmon Overview From the Microsoft Docs, "System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time. By collecting the events it genera

Sysmon, a tool used to monitor and log events on Windows, is commonly used by enterprises as part of their monitoring and logging solutions. Part of the Windows Sysinternals package, Sysmon is similar to Windows Event Logs with further detail and granular control. This room uses a modified version of the Blue and Ice boxes, as well as Sysmon logs from the Hololive network lab. Before completing this room we recommend completing the Windows Event Log room. It is also recommended to complete the Blue and Ice rooms to get an understanding of vulnerabilities present however is not required to cont