SysmonLens

Version: 1.0.0
Author: 0xAllow
License: MIT

SysmonLens is a PowerShell-based Sysmon analysis, threat-hunting, and forensic investigation tool for Windows.

It can analyze live Sysmon telemetry or offline .evtx files, preserve all available Sysmon EventData fields, filter activity across multiple Sysmon Event IDs, build timelines and process trees, correlate activity using ProcessGuid, and export investigation results.

---

Features

• Live Sysmon event analysis
• Offline .evtx analysis
• Full Sysmon EventData preservation
• Process, network, DNS, registry, file, WMI, pipe, and process-access filters
• ProcessGuid-based correlation
• Process tree reconstruction
• Timeline mode
• MITRE ATT&CK context
• Renamed executable hunting
• TXT, CSV, and JSON export
• detail, compact, and raw output views
• Built-in self-test and diagnostics
• Windows PowerShell 5.1 compatibility

---

Repository Structure

SysmonLens/
├── SysmonLens.ps1
├── README.md
├── LICENSE
├── CHANGELOG.md
└── examples/
    └── Community-Examples.ps1

---

Requirements

• Windows 10 / 11 or Windows Server
• Windows PowerShell 5.1+ or PowerShell 7+
• Sysmon installed for live analysis
• Permission to read:

Microsoft-Windows-Sysmon/Operational

Offline .evtx analysis does not require the Sysmon service to be running.

---

Quick Start

Run the built-in parser test:

.\SysmonLens.ps1 --self-test

Check access to the Sysmon event source:

.\SysmonLens.ps1 --diagnose

Display the version:

.\SysmonLens.ps1 --version

Show all available options:

.\SysmonLens.ps1 --help

---

Process Create Analysis

Start Notepad:

notepad.exe

Search for its Sysmon Process Create event:

.\SysmonLens.ps1 `
    --event 1 `
    --name notepad.exe

Display all available fields:

.\SysmonLens.ps1 `
    --event 1 `
    --name notepad.exe `
    --view raw

Compact output:

.\SysmonLens.ps1 `
    --event 1 `
    --view compact

---

Multiple Event IDs

SysmonLens accepts several PowerShell-friendly forms:

.\SysmonLens.ps1 --event 8,10,25

.\SysmonLens.ps1 --event "8,10,25"

.\SysmonLens.ps1 --event 8 10 25

Example with MITRE ATT&CK context:

.\SysmonLens.ps1 `
    --event 8,10,25 `
    --mitre `
    --view detail

Registry-related events:

.\SysmonLens.ps1 `
    --event 12,13,14 `
    --target-object '\CurrentVersion\Run'

---

Full Sysmon EventData Preservation

SysmonLens does not depend on a small hard-coded field list.

Each Sysmon event is converted from XML and all named EventData fields are preserved.

For Process Create events, depending on the installed Sysmon version and schema, fields can include:

RuleName
UtcTime
ProcessGuid
ProcessId
Image
FileVersion
Description
Product
Company
OriginalFileName
CommandLine
CurrentDirectory
User
LogonGuid
LogonId
TerminalSessionId
IntegrityLevel
Hashes
ParentProcessGuid
ParentProcessId
ParentImage
ParentCommandLine
ParentUser

To inspect the Sysmon schema installed on the local system:

sysmon -s

---

Live Query Behavior

Live Sysmon hunting uses a conservative default window of the newest 50 matching events.

Example:

.\SysmonLens.ps1 --event 1

To expand the live search:

.\SysmonLens.ps1 `
    --event 1 `
    --last 5000

--last is an explicit event-read limit.

---

Offline EVTX Analysis

Offline forensic analysis searches the complete EVTX file by default.

.\SysmonLens.ps1 `
    --evtx .\case.evtx `
    --timeline

Filter Process Create events:

.\SysmonLens.ps1 `
    --evtx .\case.evtx `
    --event 1 `
    --name powershell.exe `
    --view raw

Only use --last when you intentionally want to restrict the offline search:

.\SysmonLens.ps1 `
    --evtx .\case.evtx `
    --event 1 `
    --last 500

The standard Sysmon log filename can also be resolved against the Windows Event Log directory:

.\SysmonLens.ps1 `
    --evtx .\Microsoft-Windows-Sysmon%4Operational.evtx `
    --timeline

---

Process Tree

Build a process tree from live Sysmon telemetry:

.\SysmonLens.ps1 `
    --tree `
    --last 1000

Build a process tree from an offline EVTX:

.\SysmonLens.ps1 `
    --evtx .\case.evtx `
    --tree

SysmonLens uses:

ProcessGuid
ParentProcessGuid

for process-tree relationships instead of relying only on PIDs.

---

ProcessGuid Correlation

Find a process GUID:

.\SysmonLens.ps1 `
    --event 1 `
    --name powershell.exe `
    --fields TimeCreated,ProcessId,ProcessGuid,Image,CommandLine

Follow related Sysmon activity:

.\SysmonLens.ps1 `
    --guid "{PROCESS-GUID}" `
    --follow-guid `
    --timeline `
    --last 1000

For offline EVTX analysis, omit --last to correlate across the complete file.

---

Network Analysis

Sysmon Network Connect events use Event ID 3.

.\SysmonLens.ps1 `
    --event 3 `
    --dst-port 443

Filter by destination IP:

.\SysmonLens.ps1 `
    --event 3 `
    --dst-ip 1.1.1.1

Filter by protocol:

.\SysmonLens.ps1 `
    --event 3 `
    --protocol tcp

Event ID 3 must be enabled in the active Sysmon configuration.

---

DNS Analysis

Sysmon DNS Query events use Event ID 22.

.\SysmonLens.ps1 `
    --event 22 `
    --query-name example.com

---

Registry Analysis

Common registry telemetry uses Event IDs 12, 13, and 14.

.\SysmonLens.ps1 `
    --event 12,13,14 `
    --target-object '\CurrentVersion\Run'

---

File Analysis

Sysmon File Create events use Event ID 11.

.\SysmonLens.ps1 `
    --event 11 `
    --target-filename '\Temp\'

You can also use:

.\SysmonLens.ps1 --preset Files --timeline

---

Process Access

Sysmon Process Access uses Event ID 10.

Example:

.\SysmonLens.ps1 `
    --event 10 `
    --target-image lsass.exe

Event ID 10 can generate high-volume telemetry. Narrow filters are recommended.

---

WMI and Named Pipes

WMI telemetry:

.\SysmonLens.ps1 `
    --preset WMI `
    --timeline

Named pipe telemetry:

.\SysmonLens.ps1 `
    --preset Pipes `
    --timeline

---

Presets

Available presets:

Process
Network
DNS
Persistence
Injection
Files
WMI
Pipes
All

Example:

.\SysmonLens.ps1 `
    --preset Persistence `
    --since 2h `
    --timeline

---

Renamed Executable Hunting

Compare Image against OriginalFileName:

.\SysmonLens.ps1 `
    --event 1 `
    --renamed

This can help identify executables whose current filename differs from the original PE metadata filename.

A mismatch is not automatically malicious and should be investigated in context.

---

MITRE ATT&CK Context

Add basic ATT&CK context:

.\SysmonLens.ps1 `
    --event 8,10,25 `
    --mitre `
    --view detail

The MITRE field is contextual.

A Sysmon Event ID alone is not enough to determine that a technique occurred. Always evaluate the complete activity chain.

---

Output Views

Detail

--view detail

Displays events in a readable field-by-field format.

Compact

--view compact

Displays one event per line for fast hunting.

Raw

--view raw

Displays all available PowerShell properties.

---

Timeline

Sort results chronologically:

.\SysmonLens.ps1 `
    --preset Persistence `
    --timeline

Offline:

.\SysmonLens.ps1 `
    --evtx .\case.evtx `
    --timeline

---

Field Selection

Display selected fields:

.\SysmonLens.ps1 `
    --event 1 `
    --fields TimeCreated,ProcessGuid,ProcessId,Image,CurrentDirectory,CommandLine,ParentImage

---

Unique Values

Group events by a field:

.\SysmonLens.ps1 `
    --event 1 `
    --unique Image

---

Count Results

.\SysmonLens.ps1 `
    --event 1 `
    --count

---

Export

JSON

.\SysmonLens.ps1 `
    --event 1 `
    --output .\processes.json `
    --format json `
    --overwrite

CSV

.\SysmonLens.ps1 `
    --event 3 `
    --output .\network.csv `
    --format csv `
    --overwrite

TXT

.\SysmonLens.ps1 `
    --preset Persistence `
    --output .\persistence.txt `
    --format txt `
    --overwrite

---

Live Watch

Monitor new live Sysmon events:

.\SysmonLens.ps1 `
    --event 1 `
    --watch

Network monitoring:

.\SysmonLens.ps1 `
    --preset Network `
    --watch `
    --poll 2

Press Ctrl+C to stop.

--watch is available only for the live Sysmon event channel.

---

Zero-Result Behavior

A valid Windows Event Log query can return no matching records.

SysmonLens treats this as a valid empty result:

[*] Scanned: 0  Matches: 0
0 matches.

It does not automatically treat an empty result as a Sysmon failure.

---

Examples

Additional commands are available in:

examples/Community-Examples.ps1

---

Defensive Use

SysmonLens is intended for:

• Blue Team labs
• DFIR
• threat hunting
• detection engineering
• incident investigation
• authorized security testing

Sysmon telemetry should be treated as evidence to investigate, not as an automatic malicious/benign verdict.

---

Author

0xAllow

---

License

SysmonLens is released under the MIT License.

See:

LICENSE