> For the complete documentation index, see [llms.txt](https://docs.golgothus.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.golgothus.tech/other-research/research-and-misc.-write-ups/sysmon.md).

# Sysmon

Recommended Sysmon EventIDs worth monitoring:

* Event ID 1: Process Creation
* Event ID 3: Network Connection
* Event ID 7: Image Loaded
* Event ID 8: CreateRemoteThread
* Event ID 11: File Created
* Event ID 12 / 13 / 14: Registry Event
* Event ID 15: FileCreateStreamHash
* Event ID 22: DNS Event

Filtering syntax:

* Filter by Event ID: `*/System/EventID=<ID>`
* Filter by XML Attribute/Name: `*/EventData/Data[@Name="<XML Attribute/Name>"]`
* Filter by Event Data: `*/EventData/Data=<Data>`