Sysmon Event ID 11: File created
Records files being created or overwritten, with the process that wrote them.
- Log
- Microsoft-Windows-Sysmon/Operational
- Category
- File
Why it matters
- Shows tools dropped to disk, scripts written to startup folders and mass file creation by ransomware.
What to check
Check TargetFilename and Image; watch temp, startup and public folders.
How to turn it on
Sysmon configuration including FileCreate.
MITRE ATT&CK
- T1105 Ingress Tool Transfer
- T1547.001 Registry Run Keys / Startup Folder