Microsoft bakes one of its best security tools right into Windows 11
Microsoft is apparently integrating System Monitor (Sysmon) directly into Windows 11. This pro-level tool allows you to detect suspicious processes caused by malware or hackers on a Windows PC. Part of the popular Sysinternals suite, it’s free to download directly from Microsoft.
Developed by software engineer Mark Russinovich, Sysmon is a proven system tool for ambitious, professional users that allows you to analyze all processes running on a Windows PC for suspicious activity. It significantly outperforms the built-in Windows event log. (Learn more about why Sysinternals is the best for troubleshooting Windows issues.)
Sysmon is now native to Windows 11
In recent Windows Insider blog posts, Microsoft announced that Sysmon is now natively integrated into the operating system starting with Windows 11 Insider Preview Builds 26300.7733 (Dev Channel) and 26220.7752 (Beta Channel). Microsoft writes:
“Windows now brings Sysmon functionality natively to Windows. Sysmon functionality allows you to capture system events that can help with threat detection, and you can use custom configuration files to filter the events you want to monitor. The captured events are written on the Windows event log, enabling them to be used with security applications and a wide range of use cases.”
If the standalone version of Sysmon is already installed on your Windows PC, you must uninstall it before enabling the native version.
Users can enable and start using Sysmon in Windows Settings under Settings > System > Optional features > More Windows features (where Sysmon is disabled by default).
Alternatively, you can enable Sysmon using the command line via either Command Prompt or PowerShell:
Dism /Online /Enable-Feature /FeatureName:Sysmon
Afterwards, enter the following command:
sysmon -i
This will install the native Sysmon on your system using default configuration, start monitoring system activity, and start logging events.
Further reading: I decided to reset my Windows due to these signs