Sysmon Event ID 2


2: A process changed a file creation time

This is an event from Sysmon.

On this page

The change file creation time event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.

Free Security Log Resources by Randy

Description Fields in 2

  • Log Name
  • Source
  • Logged
  • Event ID
  • Task Category
  • Level
  • Keywords
  • User
  • Computer
  • OpCode
  • Description
  • RuleName
  • UtcTime
  • ProcessGuid
  • ProcessId
  • Image
  • TargetFilename
  • CreationUtcTime
  • PreviousCreationUtcTime
  • User

Supercharger Enterprise


Examples of 2

File creation time changed:
UtcTime: 2017-07-30 23:26:47.321
ProcessGuid: {a23eae89-ef48-5978-0000-00104832b112}
ProcessId: 25968
Image: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
TargetFilename: C:\Users\rsmith.LAB\AppData\Local\Google\Chrome\User Data\Default\c61f44ce-5bb0-4efe-acc1-246fa8a3df1d.tmp
CreationUtcTime: 2016-11-25 18:21:47.692
PreviousCreationUtcTime: 2017-07-30 23:26:47.317
User: LAB\Administrator

Event Xml:
<Event xmlns="">
    <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
    <TimeCreated SystemTime="2017-07-30T23:26:47.322369100Z" />
    <Correlation />
    <Execution ProcessID="4740" ThreadID="5948" />
    <Security UserID="S-1-5-18" />
    <Data Name="RuleName">-</Data>
    <Data Name="UtcTime">2017-07-30 23:26:47.321</Data>
    <Data Name="ProcessGuid">{A23EAE89-EF48-5978-0000-00104832B112}</Data>
    <Data Name="ProcessId">25968</Data>
    <Data Name="Image">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Data>
    <Data Name="TargetFilename">C:\Users\rsmith.LAB\AppData\Local\Google\Chrome\User Data\Default\c61f44ce-5bb0-4efe-acc1-246fa8a3df1d.tmp</Data>
    <Data Name="CreationUtcTime">2016-11-25 18:21:47.692</Data>
    <Data Name="PreviousCreationUtcTime">2017-07-30 23:26:47.317</Data>
    <Data Name="User">LAB\Administrator</Data>

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Upcoming Webinars
    Additional Resources