Sysmon Event ID 29 — File executable detected — SecOps Tools

Why event 29 matters

Detects executable files appearing in monitored directories without requiring the file to run. Useful for detecting dropped malware before execution — proactive detection of staged payloads.

How to detect it

Alert: executables appearing in web server directories, temp folders, or non-standard locations. Use hashes to check threat intel immediately.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Initial Access	Exploit Public-Facing Application (T1190)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 29   // File executable detected
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=29
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# File executable detected — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 29 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 29?

File executable detected. An executable file was detected in a monitored location. TargetFilename and Hashes are key.

Which log records event 29?

Event 29 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 29?

Event 29 is associated with: Exploit Public-Facing Application (T1190).

How do you detect activity around event 29?

Alert: executables appearing in web server directories, temp folders, or non-standard locations. Use hashes to check threat intel immediately.