Sysmon

Sysmon 15.22

System activity monitor

  • By Sysinternals
  • Proprietary
  • Updated Sep 10, 2026
Download for Windows

About Sysmon

System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.

Technical details

PublisherSysinternals
AuthorMark Russinovich & Thomas Garnier
Version15.22
Release date2026-09-10
LicenseProprietary
Installer typezip
Architecturex86
Package IDMicrosoft.Sysinternals.Sysmon

Links & install command

Install Sysmon from the command line with Windows Package Manager (winget):

winget install --id=Microsoft.Sysinternals.Sysmon -e

sysinternals