Hello @holollollol
You may need to run a Startup task to run sysmon with the system, like: > Sysmon.exe -i config.xml -a sysmondelete
Other usage of Sysmon: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Hope this helps with your query,
--------------
--If the reply is helpful, please Upvote and Accept as answer--