Please check the URL.
/docs/reference/security/prebuilt-rules/audit_policies/windows/sysmon_eventid2_file_creation_time_changed