Techniques
Sample rules
Sysmon File Executable Creation Detected
- source: sigma
- technicques:
Description
Detects Portable Executable (PE) files creation events logged by Sysmon in paths monitored by the used Sysmon configuration. This is a high-value detection for catching unauthorized or suspicious executable drops. Alert volume and scope depend entirely on which paths or files are monitored in the Sysmon config. A high noise level or hits from known-legitimate software are a strong signal that the Sysmon configuration is too permissive, not that the detection itself is wrong and probably needs to be tuned to a more restrictive set of paths or files.
Detection logic
condition: selection
selection:
EventID: 29