Sysmon event logs

Location & availability

Microsoft-Windows-Sysmon/Operational event log

Sysmon is optional. Filtering can exclude events; installing it now does not recover earlier activity.

Fields to examine

• Event 1 image, command line, hashes and ProcessGuid when recorded.
• Event 3 connection details if network logging is enabled.
• Event-specific fields, host, event time and configuration context.

What it can establish

• Link configured process telemetry and subsequent events through ProcessGuid.
• Support a specific recorded network, file or process event.

What it cannot prove

• Treat all event types as enabled by default.
• Use a signed image or a connection event alone as proof of cheating.

Use it in a screenshare

1. Preserve the event log and identify when Sysmon was installed and what configuration covered the session.
2. Start from a relevant process event, then join by ProcessGuid where available rather than PID alone.
3. Check the exact event semantics before interpreting file-time changes, DLL loads or network activity. Retain benign application explanations.

Worked example

A process creation and network event share a ProcessGuid. This links that process to the recorded connection. It does not reveal encrypted traffic contents or establish that a remote service supplied a cheat.

Cross-check the finding

• Security event 4688 →Support process creation recorded by the audited host.
• Live network connections →Support an observed endpoint/state association with a process at collection.
• USN Journal / $UsnJrnl →Support recorded file/directory changes and a sequence within retained journal coverage.

Sources

• Microsoft — Sysmon events and configuration ↗