Event ID 2

Logs when a file's creation time is retroactively modified

Source:

Microsoft-Windows-Sysmon

Category:

File creation time changed (rule: FileCreateTime)

File creation time changed:
    RuleName: %1!s!
    UtcTime: %2!s!
    ProcessGuid: %3!s!
    ProcessId: %4!s!
    Image: %5!s!
    TargetFilename: %6!s!
    CreationUtcTime: %7!s!
    PreviousCreationUtcTime: %8!s!
    User: %9!s!

The change file creation time event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.

LEFT/RIGHT arrow keys for navigation

Back to List