A lightweight system service from Microsoft Sysinternals.
It runs in the background and writes detailed logs to Windows Event Log that isn’t typically logged.
Event IDs
System activity is categorised using event IDs that are different than the ones used in Windows Event Log.
A full list of Sysmon event IDs can be seen here.
Configuration
The events logged can be controlled by configuring Sysmon in an XML config file.
Popular pre-built config files are:
Running Sysmon from a config file is done by
sysmon.exe -c configfile.xml