Sysmon Event 11 (File Create) Not Logging for Files Created in User Profile
- Dominant language
- HTML
- Stars
- 5k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
* Operating System Version: Windows 10
* Deploying via (VirtualBox/VMWare/AWS/Azure/ESXi): VirtualBox
* Vagrant Version (if applicable): 2.3.2
Hello! I noticed that sysmon event 11, file creation, is not logging for files created under certain directories, such as the user profile on win10.windomain.local or wef.windomain.local. I looked through the sysmon config file located at C:\ProgramData\Sysmon on wef.windomain.local and didn't see any rules that would exclude this.
On Win10, running this command:
...I see the following sysmon log:
However, running the following:
I don't see the log in Splunk or the Event Viewer on Win10.
Any suggestions on what may be causing this?
Thanks, and love the project btw!
Contributor guide
Assessment
This issue has not been assessed yet.