diff --git a/sysmonconfig-research.xml b/sysmonconfig-research.xml
index 0338b46b..c16c0297 100644
--- a/sysmonconfig-research.xml
+++ b/sysmonconfig-research.xml
@@ -69,7 +69,7 @@
 	  <ClipboardChange onmatch="exclude"/>
 	  <ProcessTampering onmatch="exclude"/>
 	  <FileDeleteDetected onmatch="exclude"/>
-	  <FileBlockExecutable onmatch="exclude"/>
+	  <FileBlockExecutable onmatch="include"/>
 	  <FileBlockShredding onmatch="exclude"/>
   </EventFiltering>
 </Sysmon>