Sysmon Event ID 11: FileCreate
Sysmon Event ID 11 records file creation or overwrite activity and supports detection of payload staging, dropped malware, and suspicious persistence artifacts.
- Applicable version
- Sysmon 1.0 and later; FileCreate logging must be enabled
- Last reviewed
- 2026-07-10
Trigger Scenarios
Sysmon generates the event when a configured process creates or overwrites a file. Collection rules determine which paths and file types are retained.
Key Fields
Image / ProcessGuid
The process that wrote the file. Join ProcessGuid to Event ID 1 for command line and parent context.
TargetFilename
The created file path. Startup locations, temporary directories, user profiles, and script paths are common hunting areas.
CreationUtcTime
The file creation timestamp recorded by Sysmon. Use it for timeline correlation rather than as proof of original file provenance.
Common False Positives
- Browsers, installers, updaters, compilers, and endpoint agents create many files.
- Temporary directories are noisy without process and extension filters.
Related Events
MITRE ATT&CK Mapping
- T1105Ingress Tool Transfer
- T1547Boot or Logon Autostart Execution
Detection Notes
T1105 staging is concrete when TargetFilename is an executable or script under C:\\Users\\, C:\\ProgramData\\, or Startup, and Image is a browser, PowerShell, or script host. Join ProcessGuid to Event ID 1 and execution of the same file.
Sysmon
| where EventID == 11
| where TargetFilename has_any ("\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", "\\Users\\Public")
| project TimeGenerated, Computer, Image, TargetFilename, ProcessGuidindex=sysmon EventCode=11
| search TargetFilename IN ("*\\Startup\\*", "*\\Users\\Public\\*")
| table _time, host, Image, TargetFilename, ProcessGuidUtcTime: 2026-07-10 03:21:00.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
TargetFilename: C:\Users\Public\update.ps1
ProcessGuid: {11111111-2222-3333-4444-555555555555}