Sysmon Blocked Executable Event
This rule detects Sysmon Event ID 27, which signifies a "FileBlockExecutable" event. This event is generated when Sysmon's configured block policy prevents an executable file from being created or modified. This indicates an attempt to introduce or alter an executable that violates the defined security policy.
Sigma
