Sysmon

Sysmon is a Windows service that records the processes and files involved in Windows’ creation. It’s also used to identify suspicious activity.

System Monitor is a utility that displays detailed information about processes and connections on your network. It can identify suspicious activity and provide insight into how your network is being used.

The Sysmon framework is a set of rules that allow you to visualize the various security checks performed on your system. These checks can detect suspicious events, identify anomalous behavior, and gather SHA-256 hashes.

As a Windows service, Sysmon can also be used to monitor various aspects of your system. It can detect processes that are changing, and it can also log those that are already running.