huntrule

Sysmon FileBlockExecutable event: blocked executable execution attempts on Windows

Alerts when Sysmon blocks an attempted executable execution due to FileBlockExecutable policy violations.

FreeUnreviewedSigmahighv1
title: "Sysmon FileBlockExecutable event: blocked executable execution attempts on Windows"
id: bdd25e8c-2b80-48fd-8280-bd8462800631
status: test
description: This rule triggers on any Sysmon FileBlockExecutable event (EventID 27), indicating an attempt to execute an executable that violated the configured block policy. Attackers may rely on execution of unauthorized binaries or dropped malware, so blocked execution events are a strong signal of defense-impairment controls working as intended. It relies on Sysmon process/file blocking telemetry emitted by Windows (Sysmon service).
references:
  - https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_file_block_executable.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-16
modified: 2023-09-16
tags:
  - attack.defense-impairment
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 27
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 23b71bc5-953e-4971-be4c-c896cda73fc2
    type: derived

What it detects

This rule triggers on any Sysmon FileBlockExecutable event (EventID 27), indicating an attempt to execute an executable that violated the configured block policy. Attackers may rely on execution of unauthorized binaries or dropped malware, so blocked execution events are a strong signal of defense-impairment controls working as intended. It relies on Sysmon process/file blocking telemetry emitted by Windows (Sysmon service).

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.