> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/install-sysmon-client01.md).

# Install Sysmon on CLIENT01

## Objective

Install Sysmon on `CLIENT01` and apply a small lab configuration that gives us enough telemetry for the next exercises.

## What You Will Learn

This lab introduces:

* the Sysmon service and driver
* the Sysmon configuration file
* basic installation commands
* how to confirm Sysmon is running

## Requirements

Before starting, confirm that:

* `CLIENT01` starts normally
* you can sign in with an account that can perform local administrative tasks
* Windows Defender remains enabled
* the VM has a recent snapshot or known working state

## Download Sysmon

Use the official Microsoft Sysinternals Sysmon download.

Extract the files to a simple lab folder such as:

```
C:\Tools\Sysmon
```

Do not download Sysmon from unofficial software sites.

## Check the Sysmon Schema

Open **Command Prompt as Administrator** and go to the Sysmon folder:

```
cd C:\Tools\Sysmon
```

Run:

```
Sysmon64.exe -s
```

Sysmon displays the configuration schema supported by the version you downloaded.

Record the schema version shown by your installation. You will use it in the configuration file.

## Create a Lab Folder

Create a folder that we can safely use for file monitoring exercises:

```
C:\ZyberLab
```

## Create a Simple Sysmon Configuration

In `C:\Tools\Sysmon`, create a file named:

```
zyberlab-sysmon.xml
```

Use the following as a basic learning configuration. Replace `4.90` with the schema version reported by your Sysmon binary if it is different.

```xml
<Sysmon schemaversion="4.90">
  <HashAlgorithms>sha256</HashAlgorithms>
  <EventFiltering>
    <ProcessCreate onmatch="exclude" />

    <NetworkConnect onmatch="include">
      <Image condition="end with">\nslookup.exe</Image>
      <Image condition="end with">\powershell.exe</Image>
    </NetworkConnect>

    <FileCreate onmatch="include">
      <TargetFilename condition="begin with">C:\ZyberLab\</TargetFilename>
    </FileCreate>
  </EventFiltering>
</Sysmon>
```

This is a small lab configuration, not a recommended enterprise Sysmon policy.

It is designed only to make the next exercises easy to understand.

## Install Sysmon

From the elevated Command Prompt, run:

```
Sysmon64.exe -accepteula -i zyberlab-sysmon.xml
```

Read the output and confirm the installation completes successfully.

## Verify the Service

Open **Services** and look for:

```
Sysmon64
```

Depending on the Sysmon build, the displayed service name may vary slightly.

You can also check the current configuration from the elevated Command Prompt:

```
Sysmon64.exe -c
```

## Verification

The lab is complete when:

* Sysmon is installed on `CLIENT01`
* the Sysmon service is running
* the configuration loads without an error
* the folder `C:\ZyberLab` exists
* Windows Defender is still enabled

## Security Relevance

Traditional Windows logs do not always provide enough endpoint detail for an investigation. Sysmon can provide additional context about which processes ran, which process started another process, which network connections were made, and which files were created.

The value comes from understanding the activity, not simply collecting more logs.