Sysmon FileBlockExecutable event: blocked executable execution attempts on Windows
Alerts when Sysmon blocks an attempted executable execution due to FileBlockExecutable policy violations.
FreeReviewedSigma · High · v1
- Product
- windows
- Service
- sysmon
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-16
- Updated
- 2026-07-30
What it detects
This rule triggers on any Sysmon FileBlockExecutable event (EventID 27), indicating an attempt to execute an executable that violated the configured block policy. Attackers may rely on execution of unauthorized binaries or dropped malware, so blocked execution events are a strong signal of defense-impairment controls working as intended. It relies on Sysmon process/file blocking telemetry emitted by Windows (Sysmon service).
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
sysmon-fileblockexecutable-event-blocked-executable-execution-attempts-on-window-23b71bc5
title: "Sysmon FileBlockExecutable event: blocked executable execution attempts on Windows"
id: bdd25e8c-2b80-48fd-8280-bd8462800631
status: test
description: This rule triggers on any Sysmon FileBlockExecutable event (EventID 27), indicating an attempt to execute an executable that violated the configured block policy. Attackers may rely on execution of unauthorized binaries or dropped malware, so blocked execution events are a strong signal of defense-impairment controls working as intended. It relies on Sysmon process/file blocking telemetry emitted by Windows (Sysmon service).
references:
- https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_file_block_executable.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-16
modified: 2023-09-16
tags:
- attack.defense-impairment
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 27
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 23b71bc5-953e-4971-be4c-c896cda73fc2
type: derived