> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/observe-file-creation.md).

# Observe File Creation

## Objective

Create a harmless file inside the ZyberLab folder and find the related Sysmon File Create event.

Sysmon records file creation as Event ID `11` when the event is included by the active configuration.

## Create a Test File

On `CLIENT01`:

1. Open Notepad.
2. Type a short line such as:

```
ZyberLab Sysmon file test
```

3. Save the file as:

```
C:\ZyberLab\sysmon-test.txt
```

4. Close Notepad.

## Find the Event

Open the Sysmon Operational log and filter for:

```
11
```

Look for an event where the target file name is:

```
C:\ZyberLab\sysmon-test.txt
```

## Review the Important Fields

Record the fields shown in the event, especially:

* UtcTime
* ProcessGuid
* ProcessId
* Image
* TargetFilename
* CreationUtcTime
* User, if present in your Sysmon version and event

## What Happened

The activity is straightforward:

1. Notepad was running.
2. You saved a new text file.
3. Windows created the file on disk.
4. Sysmon recorded the file creation because the path matched the lab configuration.

## Investigation Questions

Use the event to answer:

1. Which process created the file?
2. What file was created?
3. Where was it created?
4. When was it created?
5. Is the location expected for that process?

## Security Relevance

File creation can help explain what a process changed on a system.

A normal application creating a file in an expected location may be harmless. An unusual process creating executables, scripts, or files in sensitive locations may deserve further investigation.

## Clean Up

After reviewing the event, you may delete:

```
C:\ZyberLab\sysmon-test.txt
```

Keep the `C:\ZyberLab` folder because later exercises may reuse it.

## Verification

The lab is complete when you can identify the process that created `sysmon-test.txt` and locate the full target file path in Event ID `11`.