Sysmon: files, registry values, and deletes

Event ID 11 is a file create or overwrite

FileCreate records that a process created or overwrote a file. The fields you need are UtcTime, ProcessGuid, Image, TargetFilename, and User. TargetFilename is the path. It does not include the file’s hash. You join the path to Autopsy for the hash and the timestamps, and you join the GUID to Event ID 1 for the command line. A create of \Temp\p4.xlsx by the powershell GUID, a second or two after the process start, is the disk event the command line led you to expect.

Overwrite and create share this ID. If the file already existed, the event can still fire. The Autopsy timestamps tell you whether a name was new. Use both. A burst of Event ID 11 under a browser’s GUID in a cache directory is ordinary once you read Image. Filter to the GUID or the payroll path first so the cache does not become the story.

Event IDs 12, 13, and 14 are three registry acts

Event ID 12 is a registry object created or deleted. Event ID 13 is a value set. Event ID 14 is a rename. Sysmon abbreviates hive roots: HKLM, HKU, HKCR, and it rewrites the current control set path to HKLM\System\CurrentControlSet. Quote the abbreviated form as the log has it, and add the full hive path if you also opened the key in Autopsy.

On a value set, the Details field includes the written data for DWORD and QWORD values. Longer data, including many strings, may not be fully present in the event. If Details does not contain the path you care about, say the value was set and confirm the data in the hive on disk. A Run key value set by the powershell GUID would be the persistence question. A Run key that does not change during the process lifetime is a negative you can write only after you looked at ID 13 for that GUID and at the hive in memory and on disk.

• ID 11, TargetFilename, created or overwritten.
• ID 12, registry object created or deleted.
• ID 13, registry value set. DWORD and QWORD data are in Details.
• ID 14, registry object renamed.
• Confirm long string data in the hive when Details is short.

Event ID 15 is an alternate stream

FileCreateStreamHash records a named stream on a file, with a hash of that stream’s contents when the config asked for one. Windows uses a Zone.Identifier stream to remember that a file came from the internet. Seeing that stream on a browser download is ordinary, and the hash is of the small zone text, not of the workbook. A stream whose name is not a zone marker, on a file in Temp, created by the powershell GUID, is a lead. You record the stream name, the file, the GUID, and the hash, then you look at the bytes in Autopsy if they are still there.

The event is evidence that a stream was written. It is not a method, and you do not need to reproduce stream creation to understand the row. If ID 15 is absent because the config did not include it, use the config note and do not treat the silence as “no streams exist.”

Event ID 23 keeps a copy, Event ID 26 records the delete

FileDelete, Event ID 23, can archive the deleted file when the configuration says to, and the event then says whether archiving happened. FileDeleteDetected, Event ID 26, logs the delete without that archived copy. If you have ID 23 and an archive path, hash the archived bytes and compare them to the workbook. If you only have ID 26, you have the path, the process, and the time, and the content has to come from the disk, from unallocated space, or not at all. Say which ID you have.

A delete of p4.xlsx after the connection would matter. Look for it on the powershell GUID and on any later GUID. If neither ID shows a delete and Autopsy still has the file, the file was present at imaging and the log shows no delete event in the export window. That is a complete sentence.

Worked case: the Temp file is created, and no Run key is set

Event ID 11 at 13:17:05 UTC, 09:17:05 Brooklyn, ProcessGuid {1b2c-4812}, TargetFilename ending in \Temp\p4.xlsx. Autopsy’s created time for that file is 09:18, and you note the one-minute-scale agreement while keeping each source’s exact time. The SHA-256 from disk matches the Documents workbook. There is no Event ID 15 for that path. There is no Event ID 13 from this GUID under a Run key. The on-disk hive agrees, as it did in the memory lesson.

No Event ID 23 or 26 names p4.xlsx inside the export window. The file is still in the image. You add those negatives to the Sysmon page. Persistence, in the form of a Run value from this process, is not in the log. The copy and the connection remain the positive events.