1200KM / tag
Microsoft Sysmon — provider tag
16 related reference pages for provider: Microsoft Sysmon.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Drive Access · telemetry
- Driver Load · telemetry
- File Creation · telemetry
- File Deletion · telemetry
- File Modification · telemetry
- Module Load · telemetry
- Named Pipe Metadata · telemetry
- Network Connection Creation · telemetry
- Process Access · telemetry
- Process Creation · telemetry
- Process Modification · telemetry
- Process Termination · telemetry
- Windows Registry Key Creation · telemetry
- Windows Registry Key Deletion · telemetry
- Windows Registry Key Modification · telemetry
- WMI Creation · telemetry
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.