Sysinternals Sysmon

v15.15Microsoft Sysinternals

System Monitor logs high-fidelity events (process create, network connect, image load, file create, WMI, DNS) to the Windows event log for SIEM ingestion. The range plays back the events the scenario models, driven by a Sysmon-style config the analyst can edit.

Category: Endpoint telemetry & host instrumentation
Package: sysinternals-sysmon
Runs on: Windows
Commands: sysmon, sysmon64

Emits authored Sysmon-shaped events into the simulated Windows event log. No driver loads and no live host is instrumented.

Install it

The scripts below install the real Microsoft Sysinternals package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-sysmon.sh

No Linux build. Run this one on a Windows host in the range.

Windows installer (PowerShell)

Install-sysmon.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

No Linux build. Run this one on a Windows host in the range.

On Windows

PowerShell Gallery

Allow signed modules for this session

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned

Install Sysinternals Sysmon

Install-Module -Name sysinternals-sysmon -Scope CurrentUser -Force

Load it
```
Import-Module sysinternals-sysmon
```

Check it worked

Confirm it resolves
```
where sysmon
```
Check the version
```
sysmon --version
```
The range reports 15.15.

Remove it

Take it off again

Uninstall-Module -Name sysinternals-sysmon

Inside the range

Tick it on the launch screen
Under Sysinternals Sysmon's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
winget install --id sysinternals-sysmon -e
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Sysinternals Sysmon

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.