Create sysmon script