SysmonObject Access

Event 23: File Delete

Logs when a file is deleted or archived for deletion. This includes deleting files from the recycle bin.

Technical Details

Sysmon Source

Event ID: 23

Sysmon- Object Access

Event Description

Logs when a file is deleted or archived for deletion. This includes deleting files from the recycle bin.

Key Log Fields

  • UtcTime - UTC timestamp of file deletion
  • ProcessGuid - Process GUID that deleted the file
  • ProcessId - Process ID
  • Image - Process executable path
  • TargetFilename - Full path of the deleted file
  • Hashes - File hashes of deleted file (if archived)
  • IsExecutable - Whether the deleted file was executable
  • Archived - Whether the file was archived before deletion

MITRE ATT&CK® Mapping (1)

T1070.004defense-evasion
File Deletion

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) functions include <code>del</code> on Windows and <code>rm</code> or <code>unlink</code> on Linux and macOS.

Contents