Introduction

In today’s fast-paced digital world, quick response to security incidents is crucial. Sysmon (System Monitor) from Microsoft’s Sysinternals suite is an essential tool for detailed system monitoring and security analysis. However, traditional installation can be time-consuming, especially in urgent situations.

This blog post introduces a PowerShell script that automates the download, extraction, and installation of Sysmon, along with applying a pre-configured setup. This rapid deployment ensures your systems are monitored and protected within minutes, enhancing your incident response capabilities and maintaining a strong security posture.

PowerShell

You can find the complete PowerShell script in my GitHub repository here: PowerShell/Install-Configure-Sysmon.ps1 at master · imabdk/PowerShell

The PowerShell script Install-Configure-Sysmon.ps1 is designed to install and configure Sysmon (System Monitor) on a Windows system. Here’s a detailed breakdown of what the script does:

1. Download Sysmon: The script downloads the Sysmon executable from the official Sysinternals website if it is not already present on the system.
2. Install Sysmon: It installs Sysmon as a service on the system. Sysmon is a Windows system service and device driver that logs system activity to the Windows event log.
3. Apply Configuration: The script applies a predefined configuration file to Sysmon. This configuration file specifies the types of events that Sysmon should monitor and log, such as process creations, network connections, and file modifications.
4. Update Configuration: If Sysmon is already installed, the script checks for updates to the configuration file and applies them if necessary. This ensures that Sysmon is always using the latest configuration settings.
5. Logging: The script logs its actions to a log file, providing a record of what it has done. This can be useful for troubleshooting and auditing purposes.
6. Error Handling: The script includes error handling to manage any issues that arise during the download, installation, or configuration process.

By automating the installation and configuration of Sysmon, this script helps ensure that Sysmon is consistently and correctly deployed across multiple systems, enhancing your ability to monitor and respond to security events.

Sysmon config

Include your preferred Sysmon configuration within the PowerShell script by setting the $sysmonConfigContent variable.

I’m using the SwiftOnSecurity configuration in my environment, which can be found here: SwiftOnSecurity/sysmon-config: Sysmon configuration file template with default high-quality event tracing

Sysmon config versioning

If you increase the $SysmonConfigVersion and rerun the installation, the Sysmon configuration will be updated with the new settings:

Uninstall

Uninstall Sysmon by running the script with the -UninstallSysmon parameter:

Deployment

Use your preferred deployment method, whether it be Configuration Manager or Microsoft Intune. The script can be deployed using either technology.