Sysmon
A free Microsoft Sysinternals service that logs detailed process, network, file and registry activity to the Windows event log.
Sysmon writes to Microsoft-Windows-Sysmon/Operational with its own event IDs: 1 process creation (with hashes, command line and parent), 3 network connection, 7 image loaded, 8 CreateRemoteThread, 10 process access (for example handles opened to LSASS), 11 file create, 12-14 registry, 22 DNS query. Filtering is controlled by an XML config; community baselines from SwiftOnSecurity and Olaf Hartong are common starting points.
It fills gaps in native Windows auditing and gives many SIEM detections, including much of the Sigma corpus, their data. A Linux version exists using eBPF.
Pitfalls: an unfiltered config produces huge volume, an over-filtered one hides attacker activity, and attackers with admin rights can unload the driver or alter the config, so alert on Sysmon service and config changes.