Hacking Trainer AcademyAmeerpet · Hyderabad
+91 86868 92922 Book free classes

SOC and blue team

Sysmon for Beginners: Install, Config and Event IDs

· 2 min read · By Thimmagurudu Bathini, Lead Trainer and Curriculum Designer

Windows logs a lot, but not always what an investigator needs. Sysmon, a free Microsoft Sysinternals tool, adds detailed events such as which process started which, what network connections it made and which files it created. SOC teams send these events to a SIEM. Install it on a Windows lab virtual machine you own.

Install

Download Sysmon from the Microsoft Sysinternals site and a community configuration file such as the one maintained by SwiftOnSecurity. In an administrator command prompt:

  • sysmon64.exe -accepteula -i sysmonconfig.xml
  • sysmon64.exe -c sysmonconfig.xml updates the configuration later.

The configuration decides what is logged, so read it before you trust it.

Where the Events Are

Open Event Viewer and go to Applications and Services Logs, Microsoft, Windows, Sysmon, Operational. Or use PowerShell:

  • Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10

Events to Learn First

  • Event ID 1: process creation, with the full command line and parent process.
  • Event ID 3: network connection, with the process and destination.
  • Event ID 7: image (DLL) loaded.
  • Event ID 11: file created.
  • Event ID 22: DNS query, with the process that asked.

Compare them with the built-in events in our Windows event IDs guide.

Try an Investigation

On the lab VM, open PowerShell, run a few harmless commands, then find them as Event ID 1. Check the parent process. A Word document that launches PowerShell is a classic warning sign; see how to analyze a phishing email. Then search the same events in a SIEM with Splunk search commands or Wazuh.

Where It Fits

Sysmon is a core tool in our SOC, Splunk, Wazuh and DFIR course, and the log work matches the modules in the CSA exam guide.

Sources and Further Reading

Want to hunt through real attack logs in a supervised lab? Book free trial classes. Contact us or call +91 86868 92922.

Courses Mentioned in This Guide

Beginner to intermediate · Course · 6 weeks, 90 hours

SOC Analyst and DFIR

The core concepts of EC-Council's CCT, CSA, ECIH and CHFI, taught hands-on with Splunk, Wazuh and forensics tools, in six weeks.

₹20,000 + GST · 6 weeks

  • CCT, CSA, ECIH, CHFI core concepts
  • Splunk and Sentinel
  • Phishing triage and hunting
  • Incident handling
  • Forensics and malware analysis
View the course →
Advanced · EC-Council certification

Certified SOC Analyst (CSA v2)

Run the SOC. Hunt threats and manage security incidents.

₹34,000 + GST

  • SOC operations
  • Threat hunting
  • SIEM management
  • Orchestration
View the certification →
Advanced · EC-Council certification

Certified Incident Handler (ECIH v3)

When the alert is real. Respond, investigate and recover.

₹34,000 + GST

  • Incident response
  • Digital forensics
  • Malware analysis
  • Legal compliance
View the certification →

More Guides

SOC and blue team · 2 min read

CyberChef for Beginners: Decode Data Like a SOC Analyst

Use CyberChef to decode Base64, hex and URL encoding, read encoded PowerShell, extract IPs and URLs, and chain steps into recipes, all in your browser.

Read the guide →
SOC and blue team · 2 min read

YARA Rules for Beginners: Examples and Cheat Sheet

YARA rules examples and cheat sheet: write a rule with strings and conditions, scan files and folders, tune false positives and hunt malware.

Read the guide →
SOC and blue team · 2 min read

What Is a SIEM? Explained for Beginners

What a SIEM does: collect logs, normalize, correlate and alert. Examples such as Splunk, Wazuh and Sentinel, use cases, limits and how to practice.

Read the guide →
SOC and blue team · 3 min read

Splunk vs Wazuh: Which Should a SOC Beginner Learn First?

Splunk or Wazuh? What each tool does in a SOC, how they differ, which appears in job listings, and how a beginner can practice both in a home lab.

Read the guide →

Start Your Cyber Security Career

Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.

Book Free Trial Classes

By submitting, you agree that Hacking Trainer Academy may contact you about courses by phone, WhatsApp or email. See our privacy notice and refund policy.

WhatsApp