Sysmon Event ID 11: FileCreate — Dropped Files, Startup Folders, KQL

What it records

Microsoft’s description: “File create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.”

The event is short: TargetFilename (the full path), CreationUtcTime (the file system’s creation timestamp), and the writer — Image, ProcessGuid, ProcessId and User — with UtcTime and RuleName. Its value comes from the writer: a file system snapshot can show that C:\Users\anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.lnk exists; event 11 shows that WINWORD.EXE, running as anna, created it ten seconds after she opened an attachment.

What is logged depends on the <FileCreate> rules. Configurations usually include the folders Microsoft names and executable or script extensions, for example:

<FileCreate onmatch="include">
  <TargetFilename condition="contains">\Start Menu\Programs\Startup\</TargetFilename>
  <TargetFilename condition="end with">.ps1</TargetFilename>
</FileCreate>

When it matters

Pattern	Reading
Image is WINWORD.EXE, EXCEL.EXE, OUTLOOK.EXE or a script host, TargetFilename ends in .exe, .dll, .ps1, .vbs, .js or .hta	A document or script dropping a payload (T1204.002, T1105)
TargetFilename in a Startup folder	Persistence at the next logon (T1547.001)
An executable written to \AppData\, \Temp\, \Users\Public\ or \ProgramData\ and then run (event 1 with the same path as Image)	A downloaded or dropped program executed
powershell.exe, certutil.exe or bitsadmin.exe writing an executable	A Windows tool used to download a file
Many files rewritten with a new extension in a short time by one process	Ransomware encrypting files
CreationUtcTime years before UtcTime on a file just written	Time stomping — look for event 2

How to investigate

Executables and scripts written by Office, Outlook, script hosts or PowerShell:

Event
| where TimeGenerated > ago(7d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 11
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend Image = tostring(f.Image), TargetFilename = tostring(f.TargetFilename), Account = tostring(f.User)
| where Image has_any ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe")
| where TargetFilename matches regex @"(?i)\.(exe|dll|ps1|vbs|js|hta|bat|cmd|scr)$"
| project TimeGenerated, Computer, Account, Image, TargetFilename

New files in Startup folders, which run at the next logon:

Event
| where TimeGenerated > ago(30d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 11
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend Image = tostring(f.Image), TargetFilename = tostring(f.TargetFilename), Account = tostring(f.User)
| where TargetFilename has @"\Start Menu\Programs\Startup\"
| project TimeGenerated, Computer, Account, Image, TargetFilename

For each dropped file, check whether it ran: a process creation event whose Image is the same path. Follow the writer’s ProcessGuid back to its own creation event for the parent and command line. If the file was deleted afterwards, Sysmon events 23 and 26 record the deletion when the configuration asks for them. Without a SIEM, open the host’s Sysmon .evtx in the EVTX viewer and filter on event 11.