Detection rules › Sigma
Sysmon File Executable Creation Detected
Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 29 | FileExecutableDetected |
Stages and Predicates
Stage 1: selection
Neighbors
Stricter alternatives (narrower than this rule)
The rules below may be useful if you find the current rule is too noisy / lacks specificity.
- Windows Executable Masquerading as Benign File Types (adds 2 filters)
- Potentially Suspicious Self Extraction Directive File Created (adds 1 filter)