NSP.Win.Sysmon

0.1.1

Sysmon as a file watch: build a config that logs a file-create event for chosen folders (and nothing else), install or apply it without clobbering someone else's, and check it is in force without elevation.

Minimum PowerShell version

5.1

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name NSP.Win.Sysmon

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name NSP.Win.Sysmon

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Network Systems Plus. All rights reserved.

Package Details

Author(s)

  • Network Systems Plus

Tags

Sysmon Sysinternals FileWatch EventLog Automation Windows NSP

Functions

Find-NSPSysmon Get-NSPSysmonStatus Install-NSPSysmon New-NSPSysmonFileWatchConfig Save-NSPSysmon Test-NSPSysmonConfig Uninstall-NSPSysmon

Dependencies

This module has no dependencies.

Release Notes

0.1.1: RuleGroupOnly include-only fragment; RuleName for trigger filtering; Save-NSPSysmon downloads Sysmon and keeps it only when Microsoft-signed.

FileList

Version History

Version Downloads Last updated
0.1.1 (current version) 8 11/2/2026