You can check FTP logs, IIS logs, and the event logs (for admin access at the time of file creation), but if it's malicious and the attacker wishes to cover their tracks then most of these files are easy to fake/corrupt etc.
The best way is to be preprepared and have an system that reacts to new files being create (usually in specific directories or with specific permissions). The system that detects this can then make a record of which services were running, incorruptible (possibly off-server) copies of logs, and which users/service-users were logged in at that time.
The only reliable way to check/monitor whether a file has been uploaded to your server is to make a record of the hashes of all files (of interest) on the server at a specific point in time, and then to compare the current files list, and their hashes, to see if a file has been uploaded (and is therefore a new file compared to the snapshot list) or if one has been changed (because the hash is different).
It's not enough to check file create/access/change times as applied by the operating system as these can be spoofed (faked) easily.
This is a lot of work, but there are file integrity tools out there - both open source and free, and commercial, that can help with the bookkeeping.
If you need to know today and you have no record of files and (for change detection) their hashes, then there is no reliable way to check for this. Checking for newly created files through a simple file search may work if it's not part of a sophisticated attack where the malicious attacker is trying to cover their tracks, but it's just not reliable.