Sysmon is a monitor of internal Windows activity, acting as a system service and driver. Tracks the activity of the file system, Registry, network stack and running applications. It starts at an early stage of system start-up, capturing virtually all the details.

To install Sysmon, run the console (CMD.exe) with administrator privileges, then enter the file directory and issue the sysmon -i command to monitor processes, or sysmon -i -n if you also want to monitor network connections. The license of the program will be displayed - if you agree with it, the program will be installed and will start working after the system restart. The basic insight into Sysmon's activity can be obtained through the System Event Viewer (Eventvwr.msc) - in the Logs of the application and services branch of the application and the service branch of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain - the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain of the domain.

There we will see a list of events, the source of which is Sysmon - details can be checked after clicking. Logs can of course be filtered and cleared, and the Sysmon's activity itself can be managed via the context menu (right mouse button) over the Operational item. To uninstall the Sysmone, use the command (in the console) sysmon -u.

This will remove the controller and the system service without having to restart. Documentation of this powerful tool can be found on the Windows Sysinternals pages.