How to Find, Export, and Investigate Sysmon Logs on Windows

Summary

A practical guide to checking Sysmon, exporting its Windows event logs, interpreting key event IDs, and troubleshooting missing or limited data. It warns that LogTotal does not sanitize uploaded EVTX files.

Key points

Sysmon logs are available in the Microsoft-Windows-Sysmon/Operational channel and can be exported as EVTX using Event Viewer or wevtutil.
The guide shows how to export events from the last 24 hours or filter for process-creation events.
Sysmon records depend on its configuration; checking and saving the current configuration helps explain missing event types.
Key events include process creation (1), network connections (3), process access (10), file creation (11), registry changes (12–14), and DNS queries (22).
Investigators can check events 4 and 16 and the System log when Sysmon events stop unexpectedly.
Log size limits can leave only a short history on busy systems; the guide recommends checking maxSize and using a SIEM for longer-term history.
LogTotal reads EVTX files directly but does not sanitize them; the article advises getting data-handling approval before uploading production-host logs.

Article Details

Defense Focus: Use Sysmon event logs to investigate Windows activity and identify logging gaps or signs that Sysmon was stopped or reconfigured.
Detection Methods: Review Event ID 1 for process creation, command lines, hashes, and parent processes.
Review Event ID 3 for per-process network connections and Event ID 22 for process-associated DNS queries.
Review Event ID 10 for one process opening another, including access to lsass.exe as a credential-dumping signal.
Review Event ID 11 for file creation and Events 12, 13, and 14 for registry changes.
Check Events 4 and 16 for Sysmon service-state or configuration changes, especially before a gap in events; correlate with the System log for service stops.
Check the Sysmon service status, active configuration, and log maxSize when expected events are absent or history is incomplete.
Data Sources: Microsoft-Windows-Sysmon/Operational EVTX log
Windows System log
Sysmon service status
Current Sysmon configuration
Rule Types: Sigma rules for Sysmon data
wevtutil XML query filters for time ranges and event IDs
Platforms: Windows hosts
Defensive Actions: Verify Sysmon is installed and its service is running before relying on its telemetry.
Review and preserve the active Sysmon configuration with each log export so missing event types can be interpreted.
Export the Operational log as EVTX using an elevated prompt; use event or time filters when appropriate.
Check the channel maxSize and account for log overwriting when determining how far back the data extends.
If events stop unexpectedly, inspect Sysmon Events 4 and 16 and the System log for service stops or configuration changes.
Obtain data-handling approval before uploading production EVTX files to LogTotal; the article says uploads are not sanitized.

MITRE ATT&CK

T1003.001 · LSASS MemoryThe article identifies Sysmon Event ID 10 showing access to lsass.exe as a classic credential-dumping signal.

Vendors

MicrosoftIn Event Viewer that’s Applications and Services Logs → Microsoft → Windows → Sysmon → Operational.

Products

LogTotalHere’s how to check that it’s running, export what it recorded, and investigate it in LogTotal.Microsoft WindowsIn Event Viewer that’s Applications and Services Logs → Microsoft → Windows → Sysmon → Operational.Windows SysmonSysmon writes to its own event log channel.