Detectionmediumtest

Sysmon File Executable Creation Detected

Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François HubautCreated Thu Jul 20693a44e9-7f26-4cb6-b787-214867672d3awindows

Log Source

Windowssysmon

ProductWindows← raw: windows

Servicesysmon← raw: sysmon

Detection Logic

detection:
    selection:
        EventID: 29  # this is fine, we want to match any FileExecutableDetected event
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

693a44e9-7f26-4cb6-b787-214867672d3a

Status

test

Level

medium

Type

Detection

Created

Thu Jul 20

Author

Path

rules/windows/sysmon/sysmon_file_executable_detected.yml

Raw Tags

attack.defense-evasion