Windows 11 now includes System Monitor (Sysmon), a tool that logs process creation, network connections, and file creation time changes to the Windows event log. Previously, it was a separate download from Sysinternals. The built-in version is an optional feature that is disabled by default, so you must enable it with PowerShell and install it with the
sysmon command. This article explains the prerequisites, the commands, how to apply your own XML configuration, and how to verify that Sysmon writes events.
Source