docs: improve description of Sysmon File Executable Creation Detected

[valmal04]

Summary of the Pull Request

Changelog

update: Sysmon File Executable Creation Detected - rewrote the description to explain the detection's value and the misconfigured-Sysmon angle

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[swachchhanda000]

Hi @valmal04,

Appreciate this PR

However, since this rule fires for any PE created in paths your Sysmon config monitors, whether SimpleHelp triggers it depends on the monitored paths, not on SimpleHelp itself. Any legitimate installer could cause the same hit for the same reason.

Rather than adding this specific fp note, I updated the description to make clear: noise from legitimate software means the Sysmon config is too permissive and should be narrowed.

[valmal04]

Thanks for clarifying Il giorno ven 14 ago 2026 alle 05:12 Swachchhanda Shrawan Poudel < ***@***.***> ha scritto:

…

***@***.**** approved this pull request. Hi @valmal04 <https://github.com/valmal04>, Appreciate this PR However, since this rule fires for any PE created in paths your Sysmon config monitors, whether SimpleHelp triggers it depends on the monitored paths, not on SimpleHelp itself. Any legitimate installer could cause the same hit for the same reason. Rather than adding this specific fp note, I updated the description to make clear: noise from legitimate software means the Sysmon config is too permissive and should be narrowed. — Reply to this email directly, view it on GitHub <#6226?email_source=notifications&email_token=BSQDT5MMIVR2RHBT3N3M6E35JZ7QHA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIOJTGM2DMOBTGIYKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#pullrequestreview-4933468320>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BSQDT5NAKBRYFGG56WV3GY35JZ7QHAVCNFSNUABEKJSXA33TNF2G64TZHM3TOMRXGY3DMMB3JFZXG5LFHM2TCNBSGIZDSMZTGOQXMAQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>