27 Sysmon log · FileBlockExecutable high severity low volume

Sysmon Event ID 27 — File block executable

Sysmon blocked file creation of an executable (requires Sysmon blocking configuration).

Why event 27 matters

Active prevention of malicious executables being written to disk. Requires Sysmon 14.1+ with blocking rules configured. When triggered, it indicates an active attempt to drop an executable to a protected location.

How to detect it

Alert on all occurrences. Review Image and TargetFilename to understand the blocked drop attempt.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic Technique
Initial Access User Execution (T1204)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 27   // File block executable
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=27
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# File block executable — add EventData fields: Image, CommandLine, ParentImage, User`
Hunt event 27 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 27?

File block executable. Sysmon blocked file creation of an executable (requires Sysmon blocking configuration).

Which log records event 27?

Event 27 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 27?

Event 27 is associated with: User Execution (T1204).

How do you detect activity around event 27?

Alert on all occurrences. Review Image and TargetFilename to understand the blocked drop attempt.