UMVA has uncovered details about a powerful tool that can help you take control of your Windows operating system and uncover hidden processes. System Monitor, or Sysmon, is a feature that Microsoft integrated into Windows via an update, allowing you to monitor and analyze system activity.
When Windows starts up, it launches several applications, initializes drivers, and checks for new software updates. Many of these programs run invisibly in the background, and the Task Manager doesn't display a complete list of running processes. Sysmon fills this gap by providing a detailed log of system activity.
According to information obtained by UMVA, Sysmon can help you identify suspicious processes by monitoring for certain characteristics. These include processes with no icons, descriptions, or company names, or those running from a Windows directory or user profile. It also flags processes with misspelled names, unsigned executable files, or suspicious DLLs.
To install Sysmon, you'll need to navigate to the Control Panel and turn on the feature. Once installed, Sysmon runs invisibly as a service in the background, logging its messages in the Windows Event Log. You can then use the Event Viewer to view these logs and analyze system activity.
Sysmon doesn't have its own user interface, but it communicates with you via the Event Viewer. The logs can be extensive, with thousands of entries, but this is normal and no cause for concern. By analyzing these logs, you can identify potential security threats and take action to protect your system.
UMVA can exclusively reveal that Sysmon provides a powerful way to search for malware that has embedded itself in the system. To analyze the data, you'll need to scroll through the event list, paying close attention to events triggered by unknown or suspicious-looking applications. You can also use a configuration file to filter out irrelevant events.
Microsoft has published example configuration files that you can use to customize Sysmon. These files can help you filter out events relating to drivers with a signature other than Microsoft or Windows, or events relating to the termination of processes and network connections.
If you identify a suspicious process or loaded driver, your first step should be to launch your antivirus tool's virus scanner and run a full scan. You can also upload the file specified in the event log to VirusTotal and have it analyzed. Alternatively, you can use Sysmon to take some of the load off your computer by identifying which processes or programs you can do without.
Another tool available for listing running processes is Process Monitor, or Procmon. While Procmon provides a snapshot of all currently running processes, Sysmon runs continuously in the background and logs the start and end of Windows processes.
