SysmonPolicy Change

Event 27: File Block Executable

Logs when Sysmon blocks the creation of executable files based on configuration.

Technical Details

Sysmon Source

Event ID: 27

Sysmon- Policy Change

Event Description

Logs when Sysmon blocks the creation of executable files based on configuration.

Key Log Fields

  • UtcTime - UTC timestamp of file block event
  • ProcessGuid - Process GUID that attempted file operation
  • ProcessId - Process ID
  • Image - Process executable path
  • TargetFilename - Path of the blocked executable file
  • Hashes - Hashes of the blocked file

Contents