SOC Event Lookup
Event ID 29FileP2

Sysmon Event ID 29: FileExecutableDetected

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 29 records creation of a new executable file.

Technical Metadata

Technical metadata for Event ID 29
Event ID29
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0011 Command and Control / T1105 Ingress Tool Transfer
Key fields to watchTargetFilename, Image / ProcessGuid, Hashes / Signature

Trigger Scenarios

Sysmon emits this event when it detects creation of a new PE-format executable file. Microsoft documents Event ID 29 as FileExecutableDetected.

Key Fields

TargetFilename

The newly detected executable file. PE files under C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, or AppData are higher-risk staging locations than managed install paths.

Image / ProcessGuid

Identifies the process that created the executable and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context.

Hashes / Signature

Use configured hash and signature fields, when present, to triage whether the executable is known-good, unsigned, or newly observed.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 29
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 29
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 29
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=29
| table _time, host, EventCode, Message
Data source
Splunk Windows Sysmon event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Sysmon Event ID 29
dataset = microsoft_windows_raw
| filter edr_event_id = 29
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Sysmon Event ID 29
title: Sysmon Event ID 29
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 29
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID29Sysmon detected creation of a new PE-format executable.Interpret EventID with the full event and correlated activity; this value alone is not proof of compromise. Source
TargetFilename.exe pathThe new executable path requiring origin, hash and execution review.Interpret TargetFilename with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1105Ingress Tool Transfer

Detection Notes

Alert when TargetFilename is a PE executable under C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, or AppData and the creating Image is a browser, script interpreter, archive utility, or remote-management process. Microsoft documents Event 29 as creation of a new PE-format executable file; MITRE T1105 covers adversaries transferring tools or files into a compromised environment. Correlate ProcessGuid to Event 1, inspect hashes/signature if available, and look for immediate Sysmon Event 1 execution or Event 3 network activity from the new file.

Common False Positives

  • Approved administration, management agents, and deployment tools can generate this telemetry.
  • Baseline expected hosts, signed binaries, and change windows before suppression.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 01:00:00.000
TargetFilename: C:\\ProgramData\\stage.exe
Image: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe
ProcessGuid: {REDACTED}
Hashes: SHA256=REDACTED

Frequently Asked Questions

What does Sysmon Event ID 29 mean?

Sysmon detected creation of a new PE-format executable.

Does Event ID 29 always indicate malicious activity?

No. Installers, compilers and updates create executables legitimately.

How should Event ID 29 be investigated?

Inspect TargetFilename, creator Image, hash and signature context and correlate subsequent execution and network activity.

Sources

Machine-readable JSON