{
  "id": "11",
  "source": "sysmon",
  "category": "File",
  "name": "FileCreate",
  "priority": "P1",
  "applicable_version": "Sysmon 1.0 and later; FileCreate logging must be enabled",
  "last_reviewed": "2026-07-10",
  "definition": "Sysmon Event ID 11 records file creation or overwrite activity and supports detection of payload staging, dropped malware, and suspicious persistence artifacts.",
  "trigger_scenarios": "Sysmon generates the event when a configured process creates or overwrites a file. Collection rules determine which paths and file types are retained.",
  "key_fields": [
    {
      "field": "Image / ProcessGuid",
      "explanation": "The process that wrote the file. Join ProcessGuid to Event ID 1 for command line and parent context."
    },
    {
      "field": "TargetFilename",
      "explanation": "The created file path. Startup locations, temporary directories, user profiles, and script paths are common hunting areas."
    },
    {
      "field": "CreationUtcTime",
      "explanation": "The file creation timestamp recorded by Sysmon. Use it for timeline correlation rather than as proof of original file provenance."
    }
  ],
  "false_positives": [
    "Browsers, installers, updaters, compilers, and endpoint agents create many files.",
    "Temporary directories are noisy without process and extension filters."
  ],
  "related_event_ids": [
    "1",
    "7",
    "13"
  ],
  "attck_mapping": [
    {
      "technique_id": "T1105",
      "technique_name": "Ingress Tool Transfer"
    },
    {
      "technique_id": "T1547",
      "technique_name": "Boot or Logon Autostart Execution"
    }
  ],
  "detection_notes": "T1105 staging is concrete when TargetFilename is an executable or script under C:\\\\Users\\\\, C:\\\\ProgramData\\\\, or Startup, and Image is a browser, PowerShell, or script host. Join ProcessGuid to Event ID 1 and execution of the same file.",
  "kql_snippet": "Sysmon\n| where EventID == 11\n| where TargetFilename has_any (\"\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\", \"\\\\Users\\\\Public\")\n| project TimeGenerated, Computer, Image, TargetFilename, ProcessGuid",
  "spl_snippet": "index=sysmon EventCode=11\n| search TargetFilename IN (\"*\\\\Startup\\\\*\", \"*\\\\Users\\\\Public\\\\*\")\n| table _time, host, Image, TargetFilename, ProcessGuid",
  "sample_log": "UtcTime: 2026-07-10 03:21:00.000\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\nTargetFilename: C:\\Users\\Public\\update.ps1\nProcessGuid: {11111111-2222-3333-4444-555555555555}",
  "source_url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
  "route": "/sysmon-events/11/",
  "canonical_url": "https://soceventlookup.com/sysmon-events/11/",
  "json_url": "/api/events/sysmon/11.json"
}