LoFP LoFP / legitimate software writing executables to monitored paths - if this occurs, narrow the sysmon configuration to more sensitive paths rather than suppressing this rule

Techniques

Sample rules

Sysmon File Executable Creation Detected

Description

Detects Portable Executable (PE) files creation events logged by Sysmon in paths monitored by the used Sysmon configuration. This is a high-value detection for catching unauthorized or suspicious executable drops. Alert volume and scope depend entirely on which paths or files are monitored in the Sysmon config. A high noise level or hits from known-legitimate software are a strong signal that the Sysmon configuration is too permissive, not that the detection itself is wrong and probably needs to be tuned to a more restrictive set of paths or files.

Detection logic

condition: selection
selection:
  EventID: 29