Detection Capability for Executable File Creation via Sysmon

This brief outlines a detection capability utilizing Sysmon Event ID 29, which specifically logs the creation of Portable Executable (PE) files. This event is generated when a file with a PE signature is written to disk in paths explicitly defined within the Sysmon configuration. Because this event relies heavily on the underlying Sysmon configuration, it is highly sensitive to the scope of paths monitored by the organization. Defenders should treat this as a foundational capability for identifying the delivery of malicious payloads, staging of tools, or persistence mechanisms where an attacker writes a new binary to the filesystem. The detection is intended to serve as a high-signal indicator of activity in sensitive directories; however, it requires careful baseline tuning to differentiate between legitimate software updates or application deployments and actual attacker-initiated executable drops.

Recommendation

• Deploy the provided Sigma rule to your SIEM to monitor for new executable files in high-risk directories.
• Audit existing Sysmon configuration files to ensure that critical directories such as system root, user profiles, and temporary storage locations are correctly monitored by the FileExecutableDetected filter.
• Implement a tuning process to suppress alerts from known-legitimate software installers by refining the Sysmon filter configuration rather than disabling the rule.
• Enable Sysmon Event ID 29 logging on all Windows endpoints to ensure the telemetry required for this detection is generated and forwarded to the SIEM.