Skip to content
Sign In
Telemetry

win:sysmon 27

FileBlockExecutable

This event is generated when Sysmon detects and blocks the creation of executable files (PE format).

Log source
Sysmon
Host type
Windows (workstation, member server, domain controller)
How to enable
Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
Tier, host type
Listed
Techniques
0
Rules depending on it
Sigma 1

Why this tier

By role

RoleTierBasis
Windows workstationListed
Windows member serverListed
Windows domain controllerListed
Windows web server (IIS), internet-facingListed

Techniques it helps detect

No ATT&CK analytic names this event. Its standing comes from the standards and rules below.

Rules that depend on it

Sigma 1

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.