52. Windows endpoint telemetry: Sysmon and ETW

The Windows agent sends process and network activity (process start and exit with command line, parent, user and hash; TCP connections; with Sysmon also file creation, DNS queries and, in the full profile, unsigned image loads) to the server for detections, process trees and attack stories. It reads two sources, best first, per kind of event:

ETW stays quiet for a kind only while a running Sysmon delivers it: process and network events under the Lawliet configuration, process events only under a site's own configuration (site configurations often list only some network connections). When Sysmon stops or its log is gone, its driver is unloaded (fltmc unload), or it reports no new process for two minutes while processes keep starting (an exclude-everything configuration), ETW sends everything again and the host shows Sysmon as degraded. The agent's own commands do not count as processes starting, so a quiet server is not flagged. Not detected: an administrator-level attacker who rewrites the Sysmon configuration to keep logging one harmless process and leave out the rest - Sysmon still delivers, so ETW stays quiet for those kinds; the change of configuration itself is logged by Sysmon (event 16) and by the log collection. While telemetry reads Sysmon, each Sysmon record is stored once: a record telemetry delivered (the server acknowledged it, by record id) is left out of the log collection; every other record - an event id telemetry does not read (registry, LSASS access, injection, WMI, pipes...), one the profile or a filter left out (an inbound connection on the light profile, a file write outside the watched paths, an excluded program, loopback traffic), one dropped by the rate limit or the queue, one the server refused - is shipped by the log collection as before, with its record id. The log collection waits for records whose telemetry batch is still on its way. Under a site's own Sysmon configuration, connections come from ETW and Sysmon's connection records go to the log collection, so a connection reaches telemetry once. A cleared Sysmon log (wevtutil cl) is noticed within a minute, read again from its start and shown on the host; records overwritten before they were read are counted as lost. When Lawliet installs Sysmon it sets its log to 256 MB (1 GB on a domain controller).

Lawliet does not ship Sysmon. Sysmon is Microsoft's. The agent gets it onto a host in one of three ways:

1. Built-in Sysmon (Windows versions that have the Sysmon optional feature, e.g. Windows 11 24H2 and later, Windows Server 2025): the agent switches the feature on and installs it with the Lawliet configuration. Only %SystemRoot%\System32\Sysmon.exe is used (never a sysmon found on PATH), and only after Windows confirms its Microsoft signature. Switching the feature on can need a restart; the host then reports Restart needed until it has restarted.
2. Sysmon64.exe you upload (older Windows): you upload Microsoft's Sysmon64.exe to the server once (52.2), a second administrator activates it (52.3), and every Windows agent without Sysmon downloads it into a folder only SYSTEM and Administrators can touch, holds the file open so nothing can change it, checks its sha256 against what the server signed, asks Windows to build its code-signing chain (which must end at Microsoft's root), checks it is Sysinternals Sysmon 15.0 or later for the host's architecture, and only then installs it. The chain is built with the certificates the signature carries, so a host without Microsoft's intermediate (offline, Server Core) still accepts genuine Sysmon. A file that fails a check is never run. Activating a newer binary upgrades the hosts Lawliet installed Sysmon on (-u force, then install). If the new install fails, that host has no Sysmon until the next attempt (an hour later) and ETW covers it meanwhile.
3. A Sysmon your site already runs: the agent uses it as it is and does not touch its configuration, unless you choose to replace site configurations (52.4).

Licence: endpoint telemetry, Sysmon management included, needs the Log collection licence feature; without it the Sysmon routes answer 403 and agents collect nothing.

The agent's telemetry profile (light, standard, full) and its own cost are set per host group with the telemetry settings; see the EDR chapters of this guide.

52.1 What each host reports#

Where: Agents > a Windows host > Endpoint telemetry > Sysmon (the panel every Sysmon step below uses) - or GET /api/v1/telemetry/sysmon/agents.

52.2 Upload Sysmon64.exe#

You need: Publish agent releases (manage_agent_releases).

1. Download Sysmon from Microsoft (Sysinternals) and extract Sysmon64.exe (Sysmon64a.exe for ARM64 hosts).
2. In the Sysmon panel choose Upload Sysmon64.exe and pick the file, or: curl -X PUT -H "Authorization: Bearer <token>" -H "Content-Type: application/octet-stream" --data-binary @Sysmon64.exe "https://<server>/api/v1/telemetry/sysmon/binaries?filename=Sysmon64.exe"

What you see: the file with its sha256, architecture and signer (CN=Microsoft Corporation, O=Microsoft Corporation, ...), and status Uploaded. Nothing is sent to hosts yet.

The server refuses a file (and records the refusal in the audit log) unless its Authenticode signature is Microsoft Corporation's and covers this exact file (PE digest, signed attributes, signer signature), the signer certificate is for code signing, the chain ends at Microsoft Root Certificate Authority 2010 or 2011, and the version resource says Sysinternals Sysmon 15.0 or later for amd64 or arm64 (older Sysmon has known privilege escalations). Each host checks the same again with Windows before running it. The same file twice is refused (409).

52.3 Activate, withdraw, delete#

You need: Publish agent releases; activating needs a second administrator's approval (four-eyes, 15).

• Activate: re-hashes the stored file, makes it the one agents install and withdraws any other active one. Returns approval required until a second administrator approves.
• Withdraw: agents stop being offered it. Hosts that already installed Sysmon keep it.
• Delete: removes a binary that is not active, with its file.

Withdraw and Delete ask you to confirm. In the panel each uploaded file is listed with its status, hash and signer; Activate is offered only for a file the server verified.

API: POST /api/v1/telemetry/sysmon/binaries/{id}/activate, POST /api/v1/telemetry/sysmon/binaries/{id}/withdraw, DELETE /api/v1/telemetry/sysmon/binaries/{id}.

52.4 Sysmon settings#

You need: Publish agent releases and a second administrator's approval.

In the Sysmon panel, under Sysmon settings:

1. Choose the values. Save Sysmon settings is enabled once something differs from what applies.
2. Choose Save Sysmon settings. The change needs a second administrator's approval: the panel says it was sent as a request and shows the number, and the form stays on what applies until it is approved.

API: PUT /api/v1/telemetry/sysmon/settings with {"mode": "auto"|"off", "config_policy": "keep_site"|"replace"}.

Switching management off does not remove Sysmon from hosts that have it.

Domain controllers: only when you opt them in#

On a domain controller Automatic does not switch Sysmon on, install it, change its configuration or upgrade it. The DC stays on ETW and reports Sysmon recommended (DC) until an administrator opts it in:

You need: Publish agent releases and a second administrator's approval.

1. In the Sysmon panel, under Domain controllers, choose a Windows host in Choose a Windows host and Add host. Hosts are chosen one by one, never by host group (a group's membership can be changed with one signature).
2. Use the x on a host to take it out of the list.
3. Save domain controllers. The list you save replaces the previous one; saving it empty withdraws every opt-in. The change needs a second administrator's approval.

API: PUT /api/v1/telemetry/sysmon/dc-opt-in with {"agent_ids": [...]} (the list replaces the previous one; an empty list withdraws every opt-in).

Opted-in DCs get the Lawliet DC configuration (52.5). A Sysmon already on a DC that is not opted in is used as it is and never changed.

52.5 The Lawliet Sysmon configuration#

Download it from the Sysmon panel with Download Lawliet configuration, or Download domain controller configuration, which leaves out the inbound connections every DC serves all day (API: GET /api/v1/telemetry/sysmon/config, domain controllers ?variant=dc). It is Lawliet's own configuration (no third-party configuration text); what it logs is the file you download. Agents check its sha256 against the signed server policy before applying it, and re-apply it when a new Lawliet version changes it (only on a Sysmon Lawliet configured, or on any Sysmon when Replace is set).

52.6 Uninstalling the agent#

The uninstaller stops the agent's ETW sessions (Lawliet-EDR, Lawliet-EDR-Kernel). Sysmon stays installed; remove it with Sysmon64.exe -u (or switch the built-in feature off) if you no longer want it.