linux:sysmon 11
FileCreate
- Log source
- Sysmon for Linux
- Host type
- Linux
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Splunk 29, Sigma 18
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Linux server | Recommended | |
| Linux web server, internet-facing | Recommended |
Techniques it helps detect
No ATT&CK analytic names this event.
Rules that depend on it
Splunk 29
- GitHub Workflow File Creation or Modification
- Java Writing JSP File
- Linux Account Manipulation Of SSH Config and Keys
- Linux Add Files In Known Crontab Directories
- Linux At Allow Config File Creation
- Linux Deletion Of Cron Jobs
- Linux Deletion Of Init Daemon Script
- Linux Deletion Of Services
- Linux Deletion of SSL Certificate
- Linux Doas Conf File Creation
- Linux EFI Bootloader File Deletion
- Linux File Created In Kernel Driver Directory
- Linux File Creation In Init Boot Directory
- Linux File Creation In Profile Directory
- Linux File Creation In System Generator Directory
- Linux High Frequency Of File Deletion In Boot Folder
- Linux High Frequency Of File Deletion In Etc Folder
- Linux MOTD Script Added
- Linux Medusa Rootkit
- Linux Possible Privilege Escalation via PYTHONPATH
- Linux Possible Ssh Key File Creation
- Linux Possible System Binary Backdoor
- Linux Service File Created In Systemd Directory
- Linux Sudoers Tmp File Creation
- Linux Suspicious Staging of Alternate System Files
- Linux Suspicious XDG Autostart
- Linux UDEV Rule Created
- Shai-Hulud 2 Exfiltration Artifact Files
- Shai-Hulud Workflow File Creation or Modification
Sigma 18
- Axios NPM Compromise File Creation Indicators - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)
- Linux Doas Conf File Creation by Sittikorn S, Teoderick Contreras
- New Cron File Created by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation by Swachchhanda Shrawn Poudel (Nextron Systems)
- Persistence Via Sudoers Files by Nasreddine Bencherchali (Nextron Systems)
- Potential SAP NetWeaver Webshell Creation - Linux by Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
- Potentially Suspicious Long Filename Pattern - Linux by @kostastsale
- Potentially Suspicious Shell Script Creation in Profile Folder by Joseliyo Sanchez, @Joseliyo_Jstnk
- Python Path Configuration File Creation - Linux by Andreas Braathen (mnemonic.io)
- Shai-Hulud Malicious GitHub Workflow Creation by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious Filename with Embedded Base64 Commands by @kostastsale
- TanStack Supply-Chain Attack File Creation Indicators - Linux by Leonardo Gasparini
- TeamPCP LiteLLM Supply Chain Attack Persistence Indicators by Swachchhanda Shrawan Poudel (Nextron Systems)
- Triple Cross eBPF Rootkit Default LockFile by Nasreddine Bencherchali (Nextron Systems)
- Triple Cross eBPF Rootkit Default Persistence by Nasreddine Bencherchali (Nextron Systems)
- UNC4841 - Barracuda ESG Exploitation Indicators by Nasreddine Bencherchali (Nextron Systems)
- UNC4841 - Email Exfiltration File Pattern by Nasreddine Bencherchali (Nextron Systems)
- Wget Creating Files in Tmp Directory by Joseliyo Sanchez, @Joseliyo_Jstnk
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| Elastic Defend endpoint events | file | Full | Elastic Defend for Linux file dataset |
| Microsoft Defender for Endpoint device tables | DeviceFileEvents | Full | Defender for Endpoint on Linux populates DeviceFileEvents |