Sysmon Archives

Winsage

September 24, 2026

Microsoft Ships September Preview Updates for Windows 11

Microsoft has released preview updates for Windows 11 versions 24H2, 25H2, and 26H1 as part of its Week D schedule. Users of versions 24H2 and 25H2 can install the preview cumulative update KB5124010, updating their systems to builds 26100.9550 and 26200.9550, respectively. Enhancements include refinements to File Explorer, support for Emoji 17.0, a new Tips widget, improved desktop backgrounds, enhanced Bluetooth functionality, upgrades to the Settings app, additional touchpad gesture controls, new key remapping options in Copilot, and Wi-Fi support in the Windows Recovery Environment. The final monthly update for Windows 11 version 24H2 will be shipped next month, with the version set to reach the end of its support lifecycle on October 13, 2026. Users of version 26H1 can install the preview cumulative update KB5124006 to upgrade to build 28000.3086. This update includes a resizable Taskbar, customizable Start menu, revamped Windows Search, improvements to File Explorer, enhanced progress indicators, and better app update support.

Winsage

September 22, 2026

Microsoft’s most useful Windows toolkit turns 30 this year, and it still doesn’t ship with Windows 11

A fresh installation of Microsoft Windows 11 includes features like Copilot but lacks certain user control tools. The Sysinternals suite, maintained by Microsoft since its acquisition in 2006, consists of over 70 utilities and has received regular updates since its establishment in 1996. Notable updates include a modern interface for DebugView and enhanced support for startup apps in Autoruns. Sysinternals tools, such as Process Explorer and Autoruns, offer advanced functionality compared to standard Windows tools. Microsoft is integrating some Sysinternals utilities into PowerToys, starting with ZoomIt, and Sysmon has been introduced in Windows 11 Insider builds. Users have expressed interest in further integration of Sysinternals tools, particularly Process Explorer.

Winsage

June 8, 2026

Meet the hidden Windows 11 tool that reveals what Task Manager misses

Microsoft has integrated Sysmon into Windows 11 through a system update, allowing it to operate in the background and log activities in the Windows Event Log. Indicators of suspicious processes include the absence of icons or descriptions, incorrect parent processes, spelling errors in names, unsigned executable files, packed executables, suspicious DLLs or services, open TCP/IP endpoints, and unusual URLs or character strings. To install Sysmon, users must access the Control Panel, enable Sysmon, and restart their PC. Activation requires running a command in the Command Prompt. Sysmon logs can be viewed in the Event Viewer under Microsoft > Windows > Sysmon > Operational. Users can filter events using an XML configuration file. After analysis, suspicious processes should be scanned with antivirus software, and files can be uploaded to VirusTotal for further examination. Sysmon continuously logs events, while Process Monitor captures snapshots of running processes, and both tools are available for free from Microsoft.

Winsage

May 11, 2026

Rustinel: Open-source endpoint detection for Windows and Linux

Open-source endpoint detection tools have typically been divided between Windows and Linux, with Windows solutions focused on Sysmon and Linux solutions on eBPF or auditd. Rustinel is a Rust-based endpoint agent that consolidates these efforts by gathering telemetry from both operating systems using ETW on Windows and eBPF on Linux, normalizing the data into a unified model. It evaluates the information against Sigma rules, YARA signatures, and atomic indicators of compromise, storing alerts in ECS-compatible NDJSON format for integration with SIEM or log-analysis platforms. Rustinel supports a range of events on Windows, including process creation, network activity, and PowerShell executions, while Linux support currently includes process, network, file, and DNS telemetry. It operates in user mode on both platforms, requiring specific conditions for installation. Unlike commercial EDR solutions that use kernel drivers, Rustinel's user-mode design prioritizes simplicity and stability, although it acknowledges limitations in tamper resistance and visibility. The agent utilizes three detection engines: Sigma for behavioral matching, YARA for scanning executables, and an IOC engine for deterministic checks. While it leverages existing content familiar to defenders, it has coverage gaps for certain advanced threats. Rustinel is available on GitHub under the Apache 2.0 license.

Winsage

May 8, 2026

Microsoft CTO confesses that 30-year-old code from the mid-90s still forms the bedrock of Windows 11 — ancient Win32 API still the backbone, but CTO says it’s ‘more relevant than ever in 2026’

Mark Russinovich, the Chief Technical Officer of Microsoft Azure, revealed that Windows 11 relies on a significant amount of legacy code from the 1990s, particularly the Win32 framework. He acknowledged the challenges posed by this legacy software while noting its continued relevance as we approach 2026. Russinovich reflected on past attempts to update the Windows API, such as WinRT, which did not meet expectations. He also highlighted that Win32 has been crucial in developing tools like Sysmon and ZoomIt, created in 1996, which remain relevant in the context of Windows 11 and PowerToys.

Winsage

May 7, 2026

Windows 11 still runs on code from the 1990s, Microsoft admits

Windows 11 relies on the Win32 API, a legacy system dating back to Windows 95, for core functionalities like right-clicking and launching applications. Microsoft’s Chief Technology Officer, Mark Russinovich, noted that the continued relevance of Win32 was unexpected, as few anticipated it would still be a primary interface in 2026. Despite attempts to modernize the Windows API with initiatives like WinRT, Win32 remains integral to many Windows operations. The separation between Win32 applications and web technologies has complicated the transition to a new API framework. Additionally, tools from Microsoft's past, such as Sysinternals, Sysmon, and ZoomIt, continue to play important roles in Windows management.

Winsage

May 7, 2026

Microsoft admits Windows 11 is still built on 90s-era Win32, and no one saw it coming

Users engage with the Win32 API when right-clicking files or launching desktop applications in Windows 11, a technology that has persisted since Windows 95. Microsoft’s Chief Technology Officer, Mark Russinovich, noted that the longevity of Win32 was unexpected, as it was not part of the company's original vision for the future. Despite attempts to replace Win32 over the past two decades, many users still have more Win32 applications than modern alternatives. Microsoft has introduced several frameworks to replace Win32, including MFC, WinForms, WPF, WinRT, and UWP, but none have fully succeeded. Developers have shown a preference for RAM-intensive web applications over native ones due to concerns about the stability of Microsoft's frameworks. Microsoft has introduced WebView2 to embed web technologies in desktop applications, leading to increased memory usage. In response to user needs, Microsoft is shifting back to native applications with WinUI 3, aiming to modernize Windows 11 while retaining access to Win32 infrastructure. The company is gradually replacing legacy Win32 UI elements with WinUI 3 components, improving performance and user experience.

Winsage

March 29, 2026

Microsoft quietly shipped 9 meaningful Windows 11 improvements this year, and they actually make the OS feel more polished

Microsoft has released a series of quality updates for Windows 11 in the first quarter of 2026, introducing several new features: - Cross-device resume allows users to resume Android apps directly on Windows 11 via the Taskbar. - Windows MIDI Services now support MIDI 0 and 2.0, including WinMM and WinRT MIDI 1.0 support. - Windows Hello Enhanced Sign-in Security now supports external fingerprint readers. - A new "Device info" card in the Settings app displays key hardware specifications. - Quick Machine Recovery is now enabled by default for Windows 11 Pro. - A new network speed test feature can be accessed via the Taskbar. - Camera settings enhancements allow management of pan and tilt controls. - Sysmon is now a native feature in Windows 11, providing advanced monitoring capabilities. - Windows 11 supports WebP images as wallpapers.

Winsage

March 12, 2026

Windows 11 KB5079473 & KB5078883 cumulative updates released

Microsoft has released cumulative updates KB5079473 and KB5078883 for Windows 11 versions 25H2, 24H2, and 23H2 as part of the March 2026 Patch Tuesday. These updates address security vulnerabilities, fix bugs, and introduce new features. Users can install the updates via Start > Settings > Windows Update or manually from the Microsoft Update Catalog. The build numbers will change to 26200.8037 for 25H2, 26100.8037 for 24H2, and 22631.6783 for 23H2. Key enhancements include improved device targeting data for Secure Boot certificates, better reliability in File Explorer searches, and various new features such as a curated selection of emojis, a new backup and restore experience, automatic activation of Quick Machine Recovery, a built-in network speed test on the taskbar, and the ability to set WebP images as desktop backgrounds. Additionally, improvements have been made to the Windows Update settings page and the reliability of waking from sleep. No new issues have been reported with this month's updates.

Winsage

March 11, 2026

I tested Windows 11 March 2026 Updates: Everything new, improved, and fixed

Microsoft has rolled out the March 2026 Patch Tuesday update for Windows 11 (KB5079473, Build 26200.8037) and Windows 10, focusing on enhancements and functional upgrades. The update applies to Windows 11 versions 25H2 and 24H2, introducing new features, security enhancements, system fixes, and reliability improvements. Key features include: - Support for Emoji 16.0, allowing users to insert new emojis through the Emoji panel. - Windows Backup restore adapted for organizational use, enabling restoration of user settings and applications during sign-in. - Quick Machine Recovery (QMR) enabled by default on more Windows 11 Pro PCs. - A Bing-powered Internet speed test tool accessible from the taskbar. - Sysmon included as a native component for system activity monitoring. - Support for WebP images as desktop wallpapers. - Remote Server Administration Tools (RSAT) supported on Windows 11 Arm64 devices. - Minor enhancements in Accounts and Camera settings. The update also includes reliability and stability improvements, such as enhanced responsiveness of the Windows Update settings page, improved sign-in screen reliability, and better performance for the Windows printing service. It lays groundwork for Secure Boot certificate updates and addresses BitLocker reliability issues. Additionally, internal AI components have been updated, and a servicing stack update (SSU) has been released to enhance Windows Update infrastructure reliability. Microsoft is also expanding the updated Start menu and battery icons to more devices and warns users about the importance of updating Secure Boot certificates before their expiration in June 2026.