Event ID 9002001 — File created

Provider: Defender-DeviceFileEvents
Channel: FileCreated

Description

File created

Fields #

Name	Description
`DeviceId`	—
`Timestamp`	—
`FileName`	—
`FolderPath`	—
`SHA256`	—
`InitiatingProcessFileName`	—

Detection Patterns #

Defender-DeviceFileEvents Event ID 9002001: File createdORSecurity-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 11: FileCreate

2 rules

Kusto Query Language

PE file dropped in Color Profile Folder (source)

Pete Bryan

Dev-0530 File Extension Rename (source)

Microsoft Security Research

References #

Microsoft Defender XDR — advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicefileevents-table