SysmonPolicy Change

Event 28: File Block Shredding

Logs when Sysmon blocks file shredding based on configuration.

Technical Details

Sysmon Source

Event ID: 28

Sysmon- Policy Change

Event Description

Logs when Sysmon blocks file shredding based on configuration.

Key Log Fields

  • UtcTime - UTC timestamp of file shredding detection
  • ProcessGuid - Process GUID attempting shredding
  • ProcessId - Process ID
  • Image - Process executable path
  • TargetFilename - Path of the file being shredded
  • IsExecutable - Whether the file is executable

Contents