About Sysmon
System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.
System activity monitor
System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.
| Publisher | Sysinternals |
|---|---|
| Author | Mark Russinovich & Thomas Garnier |
| Version | 15.22 |
| Release date | 2026-09-10 |
| License | Proprietary |
| Installer type | zip |
| Architecture | x86 |
| Package ID | Microsoft.Sysinternals.Sysmon |
Install Sysmon from the command line with Windows Package Manager (winget):
winget install --id=Microsoft.Sysinternals.Sysmon -e