Today on the 25th birthday of Sysinternals Sysmon 1.0.0 for Linux has been released and it is open source software!
This short blog is a quick overview of the capabilities to give you an idea of what you can expect from this initial release.
Installing Sysmon for Linux
Sysmon relies on their implementation of eBPF so you’ll need to compile and install that first. https://github.com/Sysinternals/SysinternalsEBPF
When eBPF is installed you can move on to compiling and installing Sysmon, it has…