Sysmon File Executable Creation Detected
This rule detects the creation of any Portable Executable (PE) file that is monitored by the Sysmon configuration. It specifically triggers on Sysmon Event ID 29, which corresponds to 'FileExecutableDetected'. This event indicates that Sysmon has identified and logged the creation of an executable file based on its internal configuration.
Sigma
