11 Sysmon log · FileCreate low severity very-high volume

Sysmon Event ID 11 — File created

A file was created or overwritten. Image (process), TargetFilename, CreationUtcTime are key.

Why event 11 matters

Dropper activity — malicious files written to disk. Persistence via startup folder writes. Ransomware dropping ransom notes. Web shells written to web server directories. Payload staging in temp directories.

How to detect it

Alert: files created in startup folders, web server directories (wwwroot, inetpub), or temp directories with executable extensions. Alert: .vbs, .ps1, .bat, .cmd, .hta files created in user paths. Very high volume — use targeted path/extension rules.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageTargetFilename

MITRE ATT&CK mapping

Tactic Technique
Initial Access Exploit Public-Facing Application (T1190)
Persistence Boot or Logon Autostart Execution (T1547)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Executable Created in Suspicious Directory
status: experimental
description: Executable file created in temp or user directory
author: theadminstack.com
date: 2026/05/16
logsource:
    category: file_event
    product: windows
detection:
    selection:
        EventID: 11
        TargetFilename|contains:
            - '\\Temp\\'
            - '\\AppData\\'
        TargetFilename|endswith:
            - '.exe'
            - '.dll'
            - '.ps1'
            - '.vbs'
            - '.hta'
    condition: selection
falsepositives:
    - Software installations
    - Legitimate scripts in user paths
level: medium
tags:
    - attack.persistence
    - attack.initial_access
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 11   // File created
// EventData holds: Image, TargetFilename
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# File created — add EventData fields: Image, TargetFilename`
Hunt event 11 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 11?

File created. A file was created or overwritten. Image (process), TargetFilename, CreationUtcTime are key.

Which log records event 11?

Event 11 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 11?

Event 11 is associated with: Exploit Public-Facing Application (T1190), Boot or Logon Autostart Execution (T1547).

How do you detect activity around event 11?

Alert: files created in startup folders, web server directories (wwwroot, inetpub), or temp directories with executable extensions. Alert: .vbs, .ps1, .bat, .cmd, .hta files created in user paths. Very high volume — use targeted path/extension rules.