← all datasets
from the project README
◆ Detection rules
sysmon-modular
MITModular Sysmon configuration mapped to ATT&CK — the baseline many EDR and log tests start from.
Summary
This is a Microsoft Sysinternals Sysmon download here configuration repository, set up modular for easier maintenance and generation of specific configs. Please keep in mind that any of these configurations should be considered a starting point, tuning per environment is strongly recommended.
- Formats
sysmon-xml- License
- MIT
- Added
- 2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
-
$ git clone https://github.com/olafhartong/sysmon-modular.git
-
$ sysmon.exe -accepteula -i sysmonconfig.xml
On Windows, in an administrator shell, with a sysmonconfig.xml generated as the README describes.
Contents
423 files 5.2 MB repository
-
.xml405 -
.md5 -
.txt4 -
.yml2 -
.csv1 -
.gif1 -
.json1 -
(no ext)1
Use it with
Commands are curated, not yet run by us.
Sysmon — Install Sysmon on a Windows test host with the generated configuration.
$ sysmon64 -accepteula -i sysmonconfig.xml