System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.
Publisher’s description
What is Sysmon?
Sysmon by Sysinternals is proprietary Windows software in the system utilities category.
Installation and requirements
The publisher provides Portable installers for 64-bit, ARM64 and 32-bit Windows. The main installer is 2.9 MB. It runs without installation (portable).
Popularity and file types
The Chocolatey package has been downloaded 730,758 times. Similar programs include AutoHotkey, Bazel and osquery.
Pros / Cons
Pros
- Native ARM64 build for Windows on Arm
- Portable: runs without installation
- Updated in the last two months
- Small download (2.9 MB)
Cons
- Proprietary licence: check the terms and price
In short: Sysmon is a system utilitie tool for 64-bit, ARM64 and 32-bit PCs.
Is Sysmon safe to download?
- The file is served by download.sysinternals.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
00ECF1B46AEC99299D3AE0BCA79DC621458BD014B20B509D7C5C8E8C8611AA54· Open the VirusTotal report for this hash - The link answered when we last checked it (October 22, 2026)
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Recent versions
All 1 versions ›| Version | Date | Size | Files |
|---|---|---|---|
| 15.22Latest | September 10, 2026 | 2.9 MB | ARM64 ZIP64-bit ZIP32-bit ZIP |
Install from the command line
Silent install ›winget install --id Microsoft.Sysinternals.Sysmon -echoco install sysmon -yProgram files (.exe): sysmon.exe
Related guide: How to use winget: install and update apps
Information
- Publisher
- Sysinternals
- Category
- System utilities
- Licence
- Proprietary
- Price
- See the publisher’s site
- Requires
- Windows 11 / 10
- Architecture
- 64-bit, ARM64, 32-bit
- Installer
- Portable
- Version
- 15.22
- Released
- September 10, 2026
- Added to the catalogue
- September 11, 2026
- Versions listed
- 1
- Chocolatey downloads
- 730,758
- Website
- learn.microsoft.com
- winget ID
- Microsoft.Sysinternals.Sysmon
- Chocolatey package
- sysmon
Ratings and reviews
No reviews yet. Be the first to rate it.
Alternatives to Sysmon
See all ›-
Open source7.8M ↓ -
Open source523.5K ↓ -
Open source1.6M ↓ -
LocalSend1.18.2Share files to nearby devices. Free, open source, cross-platform. An open source cross-platform alternative to AirDrop.Open source69.6K ↓ -
Simplenote2.24.0Simplenote is an easy way to keep notes, lists, ideas and more. Your notes stay in sync with all your devices for free.Open source33.6K ↓ -
Ditto3.25.113.0Ditto is an extension to the Windows Clipboard. You copy something to the Clipboard and Ditto takes what you copied and stores it in a database to retrieve at a later time.Open source459.2K ↓ -
Gauge1.6.28Free and open source test automation framework that takes the pain out of acceptance testingOpen source105.2K ↓ -
Hydrus Networkv665A personal booru-style media tagger that can import files and tags from your hard drive and popular websites. Content can be shared with other users via user-run servers.Open source136.4K ↓
Frequently asked questions
Is Sysmon free?
Sysmon is proprietary (closed-source) software (licence: Proprietary). Whether it costs money depends on the edition: check the publisher’s site for prices and free tiers.
Is Sysmon safe to download?
The download comes from download.sysinternals.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install Sysmon with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does Sysmon run on ARM (Windows on Arm)?
Yes, there is a native ARM64 installer.
Can I use Sysmon without administrator rights?
Yes, it is portable: unpack and run it.
What are alternatives to Sysmon?
AutoHotkey, Bazel, osquery, LocalSend and Simplenote. The alternatives page compares them.
