Config Reference

Sysmon is configured via an XML file. Understanding the structure is required to write effective tuning rules.

Configuration File Structure

<Sysmon schemaversion="4.90">

  <!-- Hashing algorithm for image hashes. * = all algorithms -->
  <HashAlgorithms>SHA256</HashAlgorithms>

  <!-- Check if signing certificates have been revoked -->
  <CheckRevocation/>

  <EventFiltering>

    <RuleGroup name="" groupRelation="or">
      <ProcessCreate onmatch="exclude">
        <!-- Exclude known-good process creation events -->
        <Image condition="is">C:\Windows\System32\svchost.exe</Image>
      </ProcessCreate>
    </RuleGroup>

    <RuleGroup name="" groupRelation="or">
      <NetworkConnect onmatch="exclude">
        <!-- Exclude known-good network connections -->
        <Image condition="begins with">C:\Program Files\CrowdStrike\</Image>
      </NetworkConnect>
    </RuleGroup>

  </EventFiltering>
</Sysmon>

Key Elements

Element	Purpose
`schemaversion`	Defines which Sysmon schema the config targets. Check with `sysmon.exe -s`.
`HashAlgorithms`	Hashing algorithm(s) used for image hashes. Use `*` for all, or `SHA256` for a single.
`CheckRevocation`	Presence of this element enables certificate revocation checking.
`EventFiltering`	Root container for all event filter rules.
`RuleGroup`	Groups one or more event type filters. `groupRelation` is `or` or `and`.
`onmatch`	`include` = only log matching events. `exclude` = log everything except matching events.

onmatch Strategy

The 262COS base config uses onmatch="exclude" (log everything, suppress known-good). This is the recommended approach for CPT missions — it maximizes visibility while reducing noise from known processes. An onmatch="include" approach only logs what explicitly matches rules, which risks missing unknown activity.

Filter Operators

Used as the condition attribute on individual filter elements.

Operator	Behavior
`is`	Exact full-string match. Most efficient.
`is not`	Negates an exact match.
`is any`	Matches any of the listed values (semicolon-separated).
`contains`	Matches if the value contains the substring anywhere.
`contains any`	Matches if the value contains any of the listed substrings (semicolon-separated).
`contains all`	Matches only if the value contains all listed substrings (semicolon-separated).
`begins with`	Matches if the value starts with the string.
`not begins with`	Negates a `begins with`.
`ends with`	Matches if the value ends with the string.
`not ends with`	Negates an `ends with`.
`image`	Matches on image name only (no path). e.g., `svchost.exe` matches regardless of full path.

CPU Cost

contains, contains any, and contains all consume more CPU than exact-match operators. On high-frequency event types like ProcessCreate and NetworkConnect, prefer is, begins with, or ends with where possible.

RuleGroup Logic

Each RuleGroup contains exactly one event type. The groupRelation attribute controls whether multiple rules inside the group use AND or OR logic.

<!-- OR logic (default): exclude if ANY rule matches -->
<RuleGroup name="" groupRelation="or">
  <ProcessCreate onmatch="exclude">
    <Image condition="is">C:\Windows\System32\svchost.exe</Image>
    <Image condition="is">C:\Windows\System32\lsass.exe</Image>
  </ProcessCreate>
</RuleGroup>

<!-- AND logic: exclude only if ALL conditions match simultaneously -->
<RuleGroup name="" groupRelation="and">
  <NetworkConnect onmatch="exclude">
    <Image condition="is">C:\Windows\System32\svchost.exe</Image>
    <DestinationPort condition="is">443</DestinationPort>
  </NetworkConnect>
</RuleGroup>

One EventType Per RuleGroup

You can only have one EventType per RuleGroup. If multiple EventTypes are placed in the same RuleGroup, only the first one is loaded — Sysmon will not error but will silently ignore the rest.

Rule Processing Order

Rules are processed in the order they appear in the config file. Once a rule matches an event and the action is taken (include/exclude), no further rules are evaluated against that event. Place more specific rules before broader ones.

Applying and Testing Configs

Command	Purpose
`sysmon.exe -i sysmonconfig.xml -accepteula`	Install Sysmon with a config
`sysmon.exe -c sysmonconfig.xml`	Apply new config to already-installed Sysmon
`sysmon.exe -n -l -i sysmonconfig.xml -accepteula`	Install with network + image load logging (for testing)
`sysmon.exe -c`	Display currently applied configuration
`sysmon.exe -s`	Print schema for the installed version
`sysmon.exe -u`	Uninstall Sysmon

Configuration File Structure​

Key Elements​

Filter Operators​

RuleGroup Logic​

Rule Processing Order​

Applying and Testing Configs​