Windows System32 Directory File Creation

[sameer.devlekar]

Hi Folks,

I get sevral alerts from my IDS system says, "Windows System32 Directory File Creation" as an event.

Could you please help me out understand the exact meaning for this alerts.

Thanks in advance,

Sameer

[johan.kellerman]

Hi

This is pretty straith forward. A file has been created in the ..%windowsroot%\system32 directory.

If you turn on verbose logging for this signature you can see what file has been created.

Br

Johan Kellerman

[sameer.devlekar]

Hi Johan,

I tried using that but, the report doesn't seem to shows any useful info. Please let me know if we have any other possible way to investigate this cause.

Thanks,

Sameer