Microsoft to Integrate Sysmon Threat Detection Natively into Windows 11

Microsoft has officially begun rolling out native System Monitor (Sysmon) functionality to Windows 11, marking a significant shift for threat hunters and security operations centers (SOCs).

Released via the Windows 11 Insider Preview Build 26300.7733 (Dev Channel) on February 3, 2026, this update embeds the popular Sysinternals tool directly into the operating system’s optional features.

For years, Sysmon has been a critical standalone utility for cybersecurity professionals, used to monitor and log system activity to the Windows event log.

By integrating it natively, Microsoft simplifies deployment for enterprise environments, allowing administrators to capture deep system events such as process creations and network connections without managing third-party downloads.

Key Technical Details

The native version functions identically to the standalone version, supporting custom configuration files to filter events and reduce log noise.

However, it is disabled by default. Administrators must explicitly enable it via Settings or PowerShell.

Important: If you currently have the standalone Sysinternals Sysmon agent installed, you must uninstall it before enabling the native Windows feature to avoid conflicts.

To enable the feature via PowerShell or Command Prompt, use the following DISM command:

powershellDism /Online /Enable-Feature /FeatureName:Sysmon

Once enabled, finalize the installation by running:

powershellsysmon -i

Alternatively, this can be managed via the GUI at Settings > System > Optional features > More Windows features.

The following table outlines the core details of this release and the specific changes introduced in the Dev Channel.

Component	Detail
Build Version	Windows 11 Insider Preview Build 26300.7733
Update Package	KB5074178 (Version 25H2)
New Security Feature	Native Sysmon Integration (Must be manually enabled)
Feature Purpose	Advanced threat detection and event logging to Windows Event Log
Prerequisite	Removal of standalone Sysmon agent
Additional Fixes	Patched OneDrive/Dropbox app freezing; File Explorer accessibility improvements
Localization	Voice Access support added for Netherlands locale

Additional Improvements

Beyond security tooling, this build addresses several stability issues. Notably, it fixes a bug where applications would freeze when interacting with files stored on OneDrive or Dropbox.

It also resolves an issue causing Outlook to hang when PST files were hosted on cloud storage.

This integration suggests Microsoft is prioritizing advanced telemetry availability out-of-the-box, streamlining how defenders collect Indicators of Compromise (IOCs).

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.