win:sysmon 11

FileCreate

File create operations are logged when a file is created or overwritten.

Log source: Sysmon
Host type: Windows (workstation, member server, domain controller)
How to enable: Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
Tier, host type: Minimum
Techniques: 155
Rules depending on it: Splunk 93, Sigma 221, Elastic 36, Microsoft Sentinel 3

Why this tier

NSA/ASD web shell guidance

By role

Role	Tier	Basis
Windows workstation	Minimum
Windows member server	Minimum
Windows domain controller	Minimum
Windows web server (IIS), internet-facing	Minimum	NSA/ASD web shell guidance

Techniques it helps detect

Rules that depend on it

Microsoft Sentinel 3

Standards and guidance naming it

Requirement	Relation	Basis
OMB M-26-14: Object and data eventsAppendix B item 5(3)	Supports an activity	our analysis: file create
OMB M-26-14: Indicators of compromiseAppendix B item 5(7)	Supports an activity	our analysis: file indicators
OMB M-26-14: Data affectedAppendix B item 5(9)	Supports an activity	our analysis: staging files created
NSA and ASD: Web shell detection guidanceDetect and Prevent Web Shell Malware (CSI PP-20-0901, April 2020)	Names this event	our analysis: file creation in web roots supports the known-good comparison the guidance asks for

EDR events that stand in for it

Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.

Product	Sensor event	Fidelity	Basis
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	PEFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	NewExecutableWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	NewExecutableRenamed	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	ScriptFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	OleFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	RtfFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	LnkFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	PdfFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	MsiFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	IsoFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	JavaScriptFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	HtmlFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	JarFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	OfficeFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	SettingsContentFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	MachOFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	ZipFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	PNGFileWritten	Partial	pySigma-backend-crowdstrike: file_event -> the *FileWritten family; the sensor reports writes of classified file types, not every file creation
Microsoft Defender for Endpoint device tables	DeviceFileEvents	Full	pySigma-backend-kusto: file_*, Sysmon EventID 11 (create), 23 (delete) -> DeviceFileEvents (ActionType FileCreated, FileModified, FileDeleted, FileRenamed)
Elastic Defend endpoint events	file	Full	Elastic Defend file dataset