Detection rules › By event

Microsoft-Windows-Sysmon event 29

3 detection rules reference this event. View event page.

Sigma (2)

Potentially Suspicious Self Extraction Directive File Created severity medium T1218
Sysmon File Executable Creation Detected severity medium

Splunk (1)

Windows Executable Masquerading as Benign File Types T1036.008