Describe the feature
The UTMStack Windows agent (v11.2.12 CE) does not collect the
Microsoft-Windows-Sysmon/Operational event channel. The channel
list is hardcoded in the agent binary.
Confirmed via binary analysis on utmstack_agent_service_windows_amd64.exe:
- ForwardedEvents → present ✅
- Microsoft-Windows-Sysmon/Operational → absent ❌
Use Case
Sysmon is an industry standard for endpoint telemetry, widely deployed
in SOC environments. Without native collection, Sysmon-based correlation
rules (ProcessCreate, NetworkConnect, LSASS access, named pipes, registry
persistence) require a WEF workaround that is complex to deploy and fails
on Windows 11 clients (OS-level restriction, error 2150859027 — confirmed
on Windows 11 24H2).
Windows Server 2022/2025 and Domain Controllers work with the WEF
workaround, but Windows 11 workstations — the majority of endpoints in
SMB environments — cannot use it.
Proposed Solution
Option 1 (preferred): Add Microsoft-Windows-Sysmon/Operational to the
list of natively collected Windows event channels in the agent binary.
Option 2: Provide a configuration mechanism to add custom event channels
without recompiling the agent — similar to a winlogbeat.yml approach.
Other Information
Environment:
- UTMStack CE v11.2.12
- Sysmon v15.21, schema 4.91
Current workaround: Windows Event Forwarding (WEF) self-subscription
Each machine runs a local WEF subscription that forwards
Microsoft-Windows-Sysmon/Operational events to its own ForwardedEvents
channel, which IS natively collected by the UTMStack agent.
Deployment: GPO script (Deploy-WEF-Sysmon-GPO.ps1) that:
- Configures WinRM and Wecsvc
- Sets ACL on Sysmon channel (Custom isolation requires explicit
Network Service permission)
- Fixes WinRM URL ACLs (netsh http delete/add urlacl)
- Creates a SourceInitiated self-subscription via wecutil
Results:
- Windows Server 2022/2025: workaround works ✅
- Domain Controllers (Server 2025): workaround works ✅
- Windows 11 24H2: workaround fails ❌
Error 2150859027: /SubscriptionManager/WEC endpoint not exposed
on Windows client SKUs — Wecsvc refuses to register as a local
subscription source. Confirmed on two distinct Windows 11 machines
after exhaustive diagnosis (DNS, firewall, URL ACL, SvcHostSplitDisable,
VBScript deprecation — all eliminated).
Full documentation and lab context:
https://doit4everyone.github.io/utmstack-lab/
Acknowledgements
Describe the feature
The UTMStack Windows agent (v11.2.12 CE) does not collect the
Microsoft-Windows-Sysmon/Operational event channel. The channel
list is hardcoded in the agent binary.
Confirmed via binary analysis on utmstack_agent_service_windows_amd64.exe:
Use Case
Sysmon is an industry standard for endpoint telemetry, widely deployed
in SOC environments. Without native collection, Sysmon-based correlation
rules (ProcessCreate, NetworkConnect, LSASS access, named pipes, registry
persistence) require a WEF workaround that is complex to deploy and fails
on Windows 11 clients (OS-level restriction, error 2150859027 — confirmed
on Windows 11 24H2).
Windows Server 2022/2025 and Domain Controllers work with the WEF
workaround, but Windows 11 workstations — the majority of endpoints in
SMB environments — cannot use it.
Proposed Solution
Option 1 (preferred): Add Microsoft-Windows-Sysmon/Operational to the
list of natively collected Windows event channels in the agent binary.
Option 2: Provide a configuration mechanism to add custom event channels
without recompiling the agent — similar to a winlogbeat.yml approach.
Other Information
Environment:
Current workaround: Windows Event Forwarding (WEF) self-subscription
Each machine runs a local WEF subscription that forwards
Microsoft-Windows-Sysmon/Operational events to its own ForwardedEvents
channel, which IS natively collected by the UTMStack agent.
Deployment: GPO script (Deploy-WEF-Sysmon-GPO.ps1) that:
Network Service permission)
Results:
Error 2150859027: /SubscriptionManager/WEC endpoint not exposed
on Windows client SKUs — Wecsvc refuses to register as a local
subscription source. Confirmed on two distinct Windows 11 machines
after exhaustive diagnosis (DNS, firewall, URL ACL, SvcHostSplitDisable,
VBScript deprecation — all eliminated).
Full documentation and lab context:
https://doit4everyone.github.io/utmstack-lab/
Acknowledgements