Sysmon File Executable Creation Detected

 1title: Sysmon File Executable Creation Detected
 2id: 693a44e9-7f26-4cb6-b787-214867672d3a
 3status: test
 4description: |
 5    Detects Portable Executable (PE) files creation events logged by Sysmon in paths monitored by the used Sysmon configuration.
 6    This is a high-value detection for catching unauthorized or suspicious executable drops.
 7    Alert volume and scope depend entirely on which paths or files are monitored in the Sysmon config.
 8    A high noise level or hits from known-legitimate software are a strong signal that the Sysmon configuration is too permissive, not that the detection itself is wrong and probably needs to be tuned to a more restrictive set of paths or files.    
 9references:
10    - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
11    - https://medium.com/@olafhartong/sysmon-15-0-file-executable-detected-40fd64349f36
12author: frack113
13date: 2023-07-20
14tags:
15    - attack.defense-impairment
16logsource:
17    product: windows
18    service: sysmon
19detection:
20    selection:
21        EventID: 29  # this is fine, we want to match any FileExecutableDetected event
22    condition: selection
23falsepositives:
24    - Legitimate software writing executables to monitored paths - if this occurs, narrow the Sysmon configuration to more sensitive paths rather than suppressing this rule
25level: medium
26regression_tests_path: regression_data/rules/windows/sysmon/sysmon_file_executable_detected/info.yml