Windows 11 can now record everything your apps do behind your back

Windows 11 now includes Sysmon, which is a flight recorder for your apps. It’s turned off by default, but once enabled it logs the programs that start and even where they connect on the Internet.

I was expecting a spy thriller when I tested it on my PC, and I got something a bit better. It clearly revealed what apps do all day and showed me how to read the results.

Two steps, one easy miss

Installing Sysmon doesn’t switch on network logging

After enabling Sysmon, clicking its Start‑menu entry briefly flashes a terminal, which may make you think something is broken. Sysmon is just a background app, so there’s really no window to open.

Here’s how to get started:

1. Open the Settings app (Windows+I).
2. Navigate to System > Optional features > More Windows features and tick the Sysmon box.
3. Launch an elevated PowerShell and run the command: sysmon -i.

The results captured by Sysmon land on the Event Viewer. So open Event Viewer and navigate to Applications and Services Logs > Microsoft > Windows > Sysmon > Operational. This may seem like a long process just to see the results, but at least you’re not downloading or installing anything new.

When I first followed these steps, the tool only showed events for programs starting and stopping. It didn’t reveal anything related to the Internet, but when I ran the command sysmon -c in PowerShell, I realized that network logging was disabled, and there were no installed rules. This was the one feature I really wanted but it needed a separate request.

For that request, I created a small XML file saved as sysmon-test.xml:

The empty exclude elements contain no exclusion conditions, so Sysmon records everything in those categories. To apply the file, I ran sysmon -c followed by its file path in an elevated PowerShell, then network events then started appearing in Event Viewer.

1,210 events in my first hour

Two sources made 97% of them

After logging my network for about an hour, I got 1,210 events, mainly produced by two programs.

svchost.exe and Chrome made up 97% of this log. A high count isn’t necessarily problematic. It’s normal for busy programs to be chatty, and when every connection gets recorded, the interesting ones sink under the routine ones. Within the “everything else” category were System and a Windows Update worker, plus a few one-off events.

I applied a Sysmon filter to ignore connections made by svchost.exe to port 53 (the port used for DNS lookups). For 10 minutes, Sysmon continued logging traffic while avoiding all connections that matched that rule. Of the 800 events, Chrome accounted for 732, and the rest were mainly shared by Edge, Slack, and a few other processes.

The observation period of this second test is different, so I wouldn’t directly compare its totals to the first hour. Also, filtering removes all matching events, including anything unusual that might use the same process and port. I would only exclude traffic I understand.

Unmasking svchost.exe

One process ID and one command gave it a name

In Task Manager you can easily spot several Service Host (svchost.exe) entries. It doesn’t give you a clue what they’re doing, but Sysmon finally gave me a way to find out.

When I grouped the 752 svchost.exe events presented by process ID, the process with ID 2656 accounted for 744 of these events. Running tasklist /svc /fi "PID eq 2656" in my terminal revealed that it was hosting Dnscache, the DNS Client service.

711 of those 744 events went to my router on port 53. The router appeared under its hostname in 381 events and its IP address in another 330, which was consistent with the DNS Client communicating with my local resolver. This realization was oddly satisfying after years of ignoring those entries.

None of this means I’d visited 711 websites. When Event ID 3 logs a connection happening, it doesn’t include the hostname that was queried, and by looking through that log you can’t tell the sites involved.

The 427 events for Chrome were harder to read. Several went to port 443, while others used port 5353 to communicate with devices on my home network, a port associated with local device discovery. wowcon.net showed up four times, and I wasn’t able to work out who runs it, but this isn’t proof of anything.

Sysmon had surfaced where a program connected, but it doesn’t explain why the connection occurred or what data was sent.

After using this tool, I think it’s best treated as a magnifying glass. I’ll always use it when I suspect a program or am just curious. Reading daily logs is tedious and will wear you down.

Throughout my testing, Sysmon’s log occupied about 5.1MiB for 3,445 events, against a 64MiB size limit, while the service used about 15.2MiB of memory. It keeps a circular log, overwriting the oldest events when it hits the cap.

Its recording is also limited to selected activities, such as which programs start and where they connect. You can’t rely on it if you need alerts or want to block a program from running or connecting to the Internet.

I find its process IDs useful. I can use tasklist to identify the program or Windows service running under a particular PID.