SOC Event Lookup
Event ID 2FileP2

Sysmon Event ID 2: A process changed a file creation time

Applicable version
Sysmon 2.0 and later
Last reviewed
2026-07-21

Quick summary

Sysmon Event ID 2 records that a monitored process changed the creation timestamp of a file, capturing both the new CreationUtcTime and the file's PreviousCreationUtcTime.

Technical Metadata

Technical metadata for Event ID 2
Event ID2
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0005 Defense Evasion / T1070.006 Timestomp
Key fields to watchCreationUtcTime / PreviousCreationUtcTime, TargetFilename, Image / ProcessGuid, User

Trigger Scenarios

Sysmon logs Event ID 2 whenever a monitored process changes a file's creation time using SetFileTime or an equivalent API. Software installers that preserve packaged timestamps, archive extraction tools, and file-copy utilities with timestamp-preservation flags generate this event legitimately; so do deliberate timestomping tools such as SetMACE or scripted calls to .NET's File.SetCreationTime.

Key Fields

CreationUtcTime / PreviousCreationUtcTime

The exact new and prior creation timestamps. A CreationUtcTime set earlier than PreviousCreationUtcTime, or earlier than the file's own compile timestamp or the host's OS install date, is inconsistent with normal file lifecycle and is Sysmon's direct timestomping signal.

TargetFilename

Full path of the file whose creation time changed. Files dropped into user-writable or temp directories are higher risk than timestamp changes on files under vendor installer paths.

Image / ProcessGuid

The process that performed the modification. ProcessGuid joins this event to the exact Event ID 1 process-creation record for that process's lifetime.

User

The account context of the process performing the change; compare against the account's normal administrative or deployment role.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 2
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 2
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 2
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=2
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 2
dataset = microsoft_windows_raw
| filter edr_event_id = 2
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 2
title: Sysmon Event ID 2
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 2
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID2A process explicitly changed a file creation timestamp.Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source
PreviousCreationUtcTimeUTC timestampPreserves the prior creation time for comparison with CreationUtcTime.Use PreviousCreationUtcTime together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1070.006Timestomp

Detection Notes

T1070.006 timestomping is concrete when PreviousCreationUtcTime and CreationUtcTime differ and the changed TargetFilename is under C:\\Users\\ or C:\\ProgramData\\. Compare the new time to the creating Event ID 11 time; a backdated executable conceals staging.

Common False Positives

  • Many MSI-based installers intentionally preserve packaged timestamps on extracted files, producing a legitimate backdated CreationUtcTime.
  • Archive extraction tools (7-Zip, tar) and robocopy /COPY:DAT commonly restore original timestamps during file copies.
  • Git checkouts and build pipelines that restore source timestamps from version control metadata.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-12 09:14:02.331
ProcessGuid: {11111111-2222-3333-4444-555555555555}
ProcessId: 5210
Image: C:\Users\Public\tools\setmace.exe
TargetFilename: C:\Windows\Temp\payload.exe
CreationUtcTime: 2019-03-01 00:00:00.000
PreviousCreationUtcTime: 2026-07-12 09:13:58.104
User: CORP\jsmith

Frequently Asked Questions

What does Sysmon Event ID 2 mean?

A process explicitly changed a file's creation timestamp.

Does Event ID 2 always indicate malicious activity?

No. Installers, archival tools, and synchronization software can legitimately preserve or alter timestamps.

How should Event ID 2 be investigated?

Compare CreationUtcTime with PreviousCreationUtcTime, inspect TargetFilename, and join ProcessGuid to Event 1.

Sources

Machine-readable JSON