New update to SysMon (v11.1) that allows for capturing alternate data streams (like Mark of the Web). This will make for interesting threat hunting and intel on downloaded files.
(via Josh Lennon on LinkedIn)
Check the offical site: https://docs.microsoft.com/en-us/sysinternals/