File Creation

A new file is created on a system or network storage. This action often signifies an operation such as saving a document, writing data, or deploying a file. Logging these events helps identify legitimate or potentially malicious file creation activities. Examples include logging file creation events (e.g., Sysmon Event ID 11 or Linux auditd logs).

This data component can be collected through the following measures:

Windows

• Sysmon: Event ID 11: Logs file creation events, capturing details like the file path, hash, and creation time.
• Windows Event Log: Enable "Object Access" auditing in Group Policy to track file creation under Event ID 4663.
• PowerShell: Real-time monitoring of file creation:Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4663}

Linux

• Auditd: Use audit rules to monitor file creation: auditctl -w /path/to/directory -p w -k file_creation
• View logs: ausearch -k file_creation
• Inotify: Monitor file creation with inotifywait: inotifywait -m /path/to/watch -e create

macOS

• Unified Logs: Use the macOS Unified Logging System to capture file creation events.
• FSEvents: Use File System Events to monitor file creation: fs_usage | grep create

Network Devices

• NAS Logs: Monitor file creation events on network-attached storage devices.
• SMB Logs: Collect logs of file creation activities over SMB/CIFS protocols.

SIEM Integration

• Forward logs from all platforms (Windows, Linux, macOS) to a SIEM for central analysis and alerting.