Microsoft to Add Sysmon Threat Detection Feature Natively to Windows 11
Microsoft has announced an update to enhance cybersecurity capabilities within the Windows ecosystem. This update, part of Windows 11 Insider Preview Build 26300.7733 (KB5074178) released to the Dev Channel, integrates the System Monitor (Sysmon) tool…
Microsoft has announced an update to enhance cybersecurity capabilities within the Windows ecosystem. This update, part of Windows 11 Insider Preview Build 26300.7733 (KB5074178) released to the Dev Channel, integrates the System Monitor (Sysmon) tool directly into the operating system.
Sysmon, previously available as a standalone tool within the Sysinternals suite, provides detailed information about process creations, network connections, and changes to file creation time. By integrating this tool natively, Microsoft aims to make advanced logging capabilities more accessible without requiring external downloads. The native version maintains core functionalities, capturing specific system events useful for threat detection and writing them directly to the Windows Event Log.
This integration supports seamless compatibility with existing Security Information and Event Management (SIEM) solutions and other security applications. Users can customize XML configuration files to filter events, allowing for precise data capture and reduced log noise.
Adopting a "secure by default" approach, Microsoft has disabled the built-in Sysmon feature by default. Administrators must enable it explicitly via the following methods:
Method Approach Steps
Method 1 Windows Settings (GUI) Navigate to Settings > System > Optional features > More Windows features, then check "Sysmon"
Microsoft has announced an update to enhance cybersecurity capabilities within the Windows ecosystem.
Method 2 PowerShell / Command Prompt Use DISM for script-based or enterprise deployment
To enable the feature, execute the following command:
powershell Dism /Online /Enable-Feature / FeatureName:Sysmon
Once enabled, install the service to begin capturing events:
Security teams currently using the standalone version of Sysmon must uninstall it before enabling the built-in version to prevent conflicts, as advised by Microsoft.
This build also addresses several stability issues, including a critical bug causing application freezes when interacting with files on OneDrive or Dropbox. Moreover, enhancements have been made to File Explorer, improving keyboard navigation and resolving folder renaming issues.
This update advances the standardization of advanced telemetry on Windows endpoints, enhancing native defenses against sophisticated threats.
Based on reporting by Cyber Security News.
