Sysmon Event ID 29: FileExecutableDetected
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-22
Quick summary
Sysmon Event ID 29 records creation of a new executable file.
Technical Metadata
| Event ID | 29 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0011 Command and Control / T1105 Ingress Tool Transfer |
| Key fields to watch | TargetFilename, Image / ProcessGuid, Hashes / Signature |
Trigger Scenarios
Sysmon emits this event when it detects creation of a new PE-format executable file. Microsoft documents Event ID 29 as FileExecutableDetected.
Key Fields
TargetFilename
The newly detected executable file. PE files under C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, or AppData are higher-risk staging locations than managed install paths.
Image / ProcessGuid
Identifies the process that created the executable and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context.
Hashes / Signature
Use configured hash and signature fields, when present, to triage whether the executable is known-good, unsigned, or newly observed.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 29
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=29
| table _time, host, EventCode, Message- Data source
- Splunk Windows Sysmon event data
- Assumptions
- Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
dataset = microsoft_windows_raw
| filter edr_event_id = 29- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
title: Sysmon Event ID 29
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 29
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This retrieves the event and is not a standalone malicious-behavior detection.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 29 | Sysmon detected creation of a new PE-format executable. | Interpret EventID with the full event and correlated activity; this value alone is not proof of compromise. Source |
| TargetFilename | .exe path | The new executable path requiring origin, hash and execution review. | Interpret TargetFilename with the full event and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1105Ingress Tool Transfer
Detection Notes
Alert when TargetFilename is a PE executable under C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, or AppData and the creating Image is a browser, script interpreter, archive utility, or remote-management process. Microsoft documents Event 29 as creation of a new PE-format executable file; MITRE T1105 covers adversaries transferring tools or files into a compromised environment. Correlate ProcessGuid to Event 1, inspect hashes/signature if available, and look for immediate Sysmon Event 1 execution or Event 3 network activity from the new file.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
Sample Log
UtcTime: 2026-07-13 01:00:00.000
TargetFilename: C:\\ProgramData\\stage.exe
Image: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe
ProcessGuid: {REDACTED}
Hashes: SHA256=REDACTEDFrequently Asked Questions
What does Sysmon Event ID 29 mean?
Sysmon detected creation of a new PE-format executable.
Does Event ID 29 always indicate malicious activity?
No. Installers, compilers and updates create executables legitimately.
How should Event ID 29 be investigated?
Inspect TargetFilename, creator Image, hash and signature context and correlate subsequent execution and network activity.
Sources
- 29: FileExecutableDetected
Microsoft Sysinternals · vendor
- Ingress Tool Transfer (T1105)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule