SOC Event Lookup
Event ID 27FileP3

Sysmon Event ID 27: FileBlockExecutable

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 27 records that Sysmon detected and blocked creation of a PE-format executable file.

Technical Metadata

Technical metadata for Event ID 27
Event ID27
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0011 Command and Control / T1105 Ingress Tool Transfer
Key fields to watchTargetFilename, Image / ProcessGuid, Hashes

Trigger Scenarios

Microsoft documents that this event is generated when Sysmon detects and blocks creation of executable files in PE format.

Key Fields

TargetFilename

The attempted executable path. User-writable locations are higher risk than managed installer directories.

Image / ProcessGuid

The process that attempted to create the executable and the join key to Event ID 1.

Hashes

Use hash values, when present, to identify the blocked executable and compare against malware intelligence.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 27
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 27
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 27
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=27
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 27
dataset = microsoft_windows_raw
| filter edr_event_id = 27
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 27
title: Sysmon Event ID 27
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 27
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID27Sysmon detected and blocked creation of a PE-format executable.Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source
TargetFilename.exeThe blocked executable path; validate actual file type and source process.Interpret TargetFilename with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1105Ingress Tool Transfer

Detection Notes

Alert when TargetFilename is a PE file under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData and Image is a browser, archive utility, PowerShell, or script host. Microsoft documents Event 27 as blocked PE-format executable creation; this supports T1105 Ingress Tool Transfer when the attempted file is a transferred tool or payload. Correlate ProcessGuid to Event 1 and look for alternate staging through Event 15 ADS or Event 29 executable detection.

Common False Positives

  • Software installers, developer tools, and Windows updates can legitimately create PE files.
  • Blocking rules must be tuned carefully to avoid interrupting approved update and build workflows.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 03:06:00.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
TargetFilename: C:\ProgramData\stage.exe
Hashes: SHA256=REDACTED
ProcessGuid: {REDACTED}

Frequently Asked Questions

What does Sysmon Event ID 27 mean?

Sysmon blocked creation of a PE-format executable file.

Does Event ID 27 always indicate malicious activity?

No. An approved policy can block legitimate installers or software delivery.

How should Event ID 27 be investigated?

Review TargetFilename, source Image and ProcessGuid, hash context, and the applicable FileBlockExecutable rule.

Sources

Machine-readable JSON