Loading story…
Microsoft is rolling out native Sysmon functionality to some Windows 11 devices in the Windows Insider program, integrating the Sysinternals System Monitor directly into the OS. Sysmon records security-relevant telemetry to the Windows Event Log (e.g., process creation/termination and, when configured, richer behaviors such as file creation, process tampering, clipboard changes, and deleted-file backup) to support threat detection and hunting; the built-in capability is disabled by default and must be explicitly enabled, with guidance to remove any separately installed Sysmon before turning on the native feature.
In parallel Windows 11 Insider builds, Microsoft is also changing Smart App Control (SAC) behavior so users can turn SAC off and later re-enable it without a full OS reinstall, reversing the prior “clean install only” design that permanently blocked reactivation after disablement. The change follows user-impacting false positives (e.g., SAC flagging ASUS Armoury Crate on ASUS ROG Ally), and Microsoft’s updated approach aims to reduce operational friction while still encouraging users to keep SAC enabled unless conflicts require disabling it.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft started rolling out built-in Sysmon support to Windows 11 Insider devices in the Beta and Dev channels through preview builds 26220.7752/KB5074177 and 26300.7733/KB5074178. The native feature writes security-relevant telemetry to the Windows Event Log, supports custom configuration files, and is disabled by default.
Microsoft updated Windows 11 Insider builds so Smart App Control can be turned off and later re-enabled without wiping and reinstalling the OS. The change applies starting with Windows 11 versions 24H2 and 25H2.
A Smart App Control false positive flagged the ASUS Armoury Crate utility on ASUS ROG Ally devices. Affected users had to choose between disabling SAC and losing its protection or waiting for a fix while device functionality was impaired.
Under Windows 11's original Smart App Control design, users could only enable the feature on a clean OS installation. If they turned it off, Windows treated the system as no longer clean, making SAC unavailable again unless Windows was reinstalled.
Microsoft said in November that it planned to bring Sysmon functionality directly into Windows 11 and Windows Server and would later publish detailed documentation. This marked the first disclosed step toward making the Sysinternals monitoring tool a built-in feature.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s latest Windows 11 preview releases for Insiders and optional updaters introduce **native Sysmon** and ship fixes for disruptive **Windows Explorer/taskbar** regressions. Windows 11 Insider Dev Channel Build `26300.7733` (KB5074178) adds Sysmon as a built-in *Optional Feature*, bringing deeper endpoint telemetry (e.g., process creation with command lines, network connections, driver loads, and file timestamp manipulation) intended to improve forensic visibility and incident investigation; Microsoft notes the integrated Sysmon conflicts with legacy standalone Sysmon installs, requiring removal of the older version before enabling the new feature. Separately, the optional preview update **KB5074105** for Windows 11 `24H2`/`25H2` addresses a January cumulative-update regression where `Explorer.exe` could hang at startup—causing the taskbar to intermittently disappear and forcing users to restart Explorer via Task Manager—and also fixes reports of desktop icons being rearranged unexpectedly. ZDNET characterizes the upcoming February Windows 11 patch as feature-heavy and indicates KB5074105 is an early look at what will roll into the broader monthly release, while other referenced ZDNET pieces are general OS commentary/comparisons and not tied to the Sysmon integration or the KB5074105 Explorer fix; an Android 17 feature roundup is unrelated.
Jun 29, 2026
Microsoft has announced significant enhancements to Windows 11 and Windows Server 2025, including the native integration of Sysmon, a powerful system monitoring tool previously available only as a standalone Sysinternals utility. With this integration, administrators will be able to deploy and manage Sysmon directly through Windows features and updates, simplifying large-scale monitoring and threat detection. Sysmon's advanced event filtering and custom configuration capabilities will remain intact, enabling organizations to monitor for suspicious activity, process tampering, and other security-relevant events without the need for separate installations. In addition to Sysmon integration, Microsoft introduced two new recovery features for Windows 11: Cloud Rebuild and Point-in-Time Restore (PITR). These tools are designed to minimize downtime and streamline recovery from system failures or problematic updates. PITR allows users and IT administrators to quickly roll back systems to healthy snapshots, restoring not only the OS but also local files and applications. Cloud Rebuild enables remote, cloud-based reinstallation of Windows 11, leveraging Intune and Autopilot for zero-touch provisioning and rapid restoration of user data and settings. Both features are set to be integrated with Microsoft Intune, providing enterprise admins with robust, remote recovery and remediation capabilities.
Jun 29, 2026
Microsoft is testing new Windows 11 privacy controls that let users allow or block **individual Win32 desktop applications** from accessing the camera, microphone, location, and in some reports voice activation. The feature appeared in Windows 11 Insider Preview Build `26340.9212` for version `26H2` in the Experimental channel, where desktop apps can now trigger system permission prompts for camera and microphone access instead of relying on the long-standing shared device-wide toggles used for traditional Win32 software. The controls were not documented in Microsoft's release notes and were first spotted by community testers, with reports indicating the rollout is limited to a subset of Insider systems and may be tied to the `Win32SignatureIdentity` feature flag. If broadly released, the change would close a notable privacy gap between classic desktop programs and Microsoft Store apps, while the same test build also completes removal of the legacy `WMIC` command-line tool, a utility frequently abused by ransomware operators during post-compromise activity.
Aug 20, 2026