Alerts

Microsoft Integrates Sysmon Directly into Windows 11 for Native Threat Detection

Zero Day Wire

05 Feb 2026 — 2 min read

Microsoft has announced the integration of System Monitor (Sysmon) directly into Windows 11, bringing one of the most widely-used threat detection tools natively into the operating system. The feature is now available in Windows 11 Insider Preview Build 26300.7733 (KB5074178) in the Dev Channel.

Previously available only as a standalone download from the Sysinternals suite, Sysmon has been a cornerstone tool for security operations teams, threat hunters, and incident responders since its release in 2014. The tool captures detailed system events — process creation, network connections, file changes, registry modifications, and more — that are critical for detecting malicious activity and conducting forensic investigations.

What This Means for Defenders

Native integration eliminates several friction points that have historically complicated Sysmon deployment at scale.

Security teams will no longer need to manage separate Sysmon installers, handle version updates independently of Windows Update, or navigate deployment conflicts with existing endpoint security tools. The integration also means Sysmon will benefit from Microsoft's standard Windows servicing and update mechanisms.

For organizations that have avoided Sysmon due to deployment complexity or concerns about maintaining yet another agent, native integration lowers the barrier significantly. Enabling the feature becomes a standard Windows configuration task rather than a third-party tool installation.

How to Enable

Built-in Sysmon is disabled by default and requires explicit enablement.

Via Settings: Navigate to Settings > System > Optional features > More Windows features and check "Sysmon"

Via Command Line:

Dism /Online /Enable-Feature /FeatureName:Sysmon

After enabling the feature, complete the installation by running:

sysmon -i

Organizations with existing Sysmon installations from the Sysinternals website must uninstall the standalone version before enabling the built-in feature.

Functionality Unchanged

Microsoft confirmed that the functionality of Sysmon remains unchanged from the standalone version. Security teams can continue using custom configuration files to filter monitored events, and captured events are written to the Windows Event Log for integration with SIEMs, security applications, and detection engineering workflows.

Existing Sysmon configurations and detection rules should remain compatible with the native implementation.

Timeline

The feature is currently rolling out gradually to Windows Insiders in the Dev Channel with the toggle enabled for latest updates. No timeline has been announced for general availability in production Windows 11 releases, but the inclusion in Dev Channel typically indicates a feature is on track for a future stable release.

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected. The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS. The campaign, which ran from

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors