SOC Event Lookup
Event ID 11FileP1

Sysmon Event ID 11: FileCreate

Applicable version
Sysmon 1.0 and later; FileCreate logging must be enabled
Last reviewed
2026-07-21

Quick summary

Sysmon Event ID 11 records file creation or overwrite activity and supports detection of payload staging, dropped malware, and suspicious persistence artifacts.

Technical Metadata

Technical metadata for Event ID 11
Event ID11
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0011 Command and Control / T1105 Ingress Tool Transfer; TA0003 Persistence / T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Key fields to watchImage / ProcessGuid, TargetFilename, CreationUtcTime

Trigger Scenarios

Sysmon generates the event when a configured process creates or overwrites a file. Collection rules determine which paths and file types are retained.

Key Fields

Image / ProcessGuid

The process that wrote the file. Join ProcessGuid to Event ID 1 for command line and parent context.

TargetFilename

The created file path. Startup locations, temporary directories, user profiles, and script paths are common hunting areas.

CreationUtcTime

The file creation timestamp recorded by Sysmon. Use it for timeline correlation rather than as proof of original file provenance.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 11
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 11
| project TimeGenerated, Computer, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event and retains RenderedDescription. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 11
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| table _time, host, user, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Sysmon Event ID 11
dataset = microsoft_windows_raw
| filter edr_event_id = 11
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Sysmon Operational channel is ingested into Cortex XDR. Event ID 11 is not globally unique; confirm Provider is Microsoft-Windows-Sysmon before applying Sysmon field semantics.
Query reference
Sigma rule: Sysmon Event ID 11
title: Sysmon Event ID 11
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
TargetFilenameC:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\This is the per-user Startup folder path pattern.A newly written executable or script here can run at user logon; verify the writer process and approved software installation context. Source

MITRE ATT&CK Mapping

  • T1105Ingress Tool Transfer
  • T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detection Notes

T1105 Ingress Tool Transfer triage is stronger when TargetFilename is an executable or script under C:\\Users\\ or C:\\ProgramData\\ and the same ProcessGuid has preceding network activity. T1547.001 persistence applies when the created file is under a per-user or all-users Startup folder; join ProcessGuid to Event ID 1 and confirm later execution of the same path.

Common False Positives

  • Browsers, installers, updaters, compilers, and endpoint agents create many files.
  • Temporary directories are noisy without process and extension filters.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-10 03:21:00.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
TargetFilename: C:\Users\Public\update.ps1
ProcessGuid: {11111111-2222-3333-4444-555555555555}

Frequently Asked Questions

What does Sysmon Event ID 11 record?

Sysmon Event ID 11 records file creation or overwrite operations that match the active Sysmon FileCreate configuration and identifies the writing process and target path.

Does Sysmon Event ID 11 record every file creation?

Only events selected by the installed Sysmon configuration are emitted; coverage and event volume therefore depend on include and exclude rules.

How can Event ID 11 support malware-staging detection?

Correlate the writing ProcessGuid with network and process events, then prioritize executable or script files in user-writable, temporary, Startup, and other execution-relevant paths.

Sources