System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time.
[00:00] - Rogue Code - The new cybersecurity novel
[00:55] - Announcing: Sysinternals System Monitor (SysMon)
[04:17] - Released August 7th 2014
[04:42] - Command Line
[05:55] - Case of My Mom's Chronically Infected PC
[12:20] - Sysinternals AutoRuns - Scheduled Tasks
[15:08] - 64Mb Event Log - weeks of activity
[16:59] - Email us your issues at email@example.com
Mark Russinovich is the Chief Technology Officer for Azure and co-founder of Sysinternals.
Thomas Garnier is Senior Security Software Developer in Trustworthy Computing.