Event ID 11: FileCreate
Contents
Event ID 11: FileCreate¶
Version: 4.81¶
Description¶
File create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the temporary and download directories, which are common places malware drops during initial infection.
Data Dictionary¶
Field Name |
Type |
Description |
Sample Value |
|---|---|---|---|
RuleName |
string |
custom tag mapped to event. i.e ATT&CK technique ID |
|
UtcTime |
date |
Time in UTC when event was created |
|
ProcessGuid |
string |
Process Guid of the process that created the file |
|
ProcessId |
integer |
Process ID used by the os to identify the process that created the file. |
|
Image |
string |
File path of the process that created the file |
|
TargetFilename |
string |
Name of the file |
|
CreationUtcTime |
date |
File creation time |
|
User |
string |
user that created the file |
|