Sysmon File Executable Creation Detected

SigmaHQ Detections@sigmaHQ

•updated Sep 3, 2026•1•0•6

Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.