Deploy Sysmon to Microsoft Intune

Published by Microsoft in Monitoring

System activity monitor

Publisher: Microsoft
Homepage: Visit publisher website
License: Proprietary
Category: Monitoring

Deployment details

Latest version: 15.22
Installer type: zip
Install scope: machine
Install command: .\payload\Invoke-AppDeployToolkit.exe
Uninstall command: .\payload\Invoke-AppDeployToolkit.exe -DeploymentType Uninstall
Detection rule: The exact Intune detection rules generated for this PSADT package
App source: win32

Commands and arguments were captured during an automated QA install of version 15.22 in an isolated Windows VM.

Tested by IntuneGet QA

Passed

Version 15.22 tested on September 11, 2026.

VirusTotal scan of the installer hash: clean. 0 of 67 engines flagged it.

Package provenance

Installer source: download.sysinternals.com
Installer SHA-256: 00ECF1B46AEC99299D3AE0BCA79DC621458BD014B20B509D7C5C8E8C8611AA54Check on VirusTotal
PSADT version: 4.1.8
Packaging commit: 7238616608
Package profile: 8EA581404003B0AD...

IntuneGet verifies the installer SHA-256 before packaging and does not store the installer. The full evidence, including the recorded hash, is in the QA report.

Recent versions

15.22
15.20
15.15

How deployment works

IntuneGet packages Sysmon as a Win32 app and uploads it directly to your Microsoft Intune tenant. You review the package settings, configure assignments, and start the deployment from one guided workflow.