win:sysmon 23
FileDelete (File Delete archived)
A file was deleted.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 8
- Rules depending on it
- Splunk 11, Sigma 14
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
Rules that depend on it
Splunk 11
- Excessive File Deletion In WinDefender Folder
- Windows ConsoleHost History File Deletion
- Windows Data Destruction Recursive Exec Files Deletion
- Windows Default Rdp File Deletion
- Windows Defender Intermediary Artifact Was Observed
- Windows High File Deletion Frequency
- Windows MSI Rollback Script Deleted By Non-Msiexec Process
- Windows Mark Of The Web Bypass
- Windows RDP Cache File Deletion
- Windows Rdp AutomaticDestinations Deletion
- Windows Suspicious Defender Update Activity in INetCache
Sigma 14
- ADS Zone.Identifier Deleted by frack113
- ADS Zone.Identifier Deleted By Uncommon Application by Nasreddine Bencherchali (Nextron Systems)
- Backup Files Deleted by frack113
- EventLog EVTX File Deleted by Nasreddine Bencherchali (Nextron Systems)
- Exchange PowerShell Cmdlet History Deleted by Nasreddine Bencherchali (Nextron Systems)
- File Deleted Via Sysinternals SDelete by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- IIS WebServer Access Logs Deleted by Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- Potential PrintNightmare Exploitation Attempt by Bhabesh Raj
- PowerShell Console History Logs Deleted by Nasreddine Bencherchali (Nextron Systems)
- Prefetch File Deleted by Cedric MAURUGEON
- Process Deletion of Its Own Executable by Max Altgelt (Nextron Systems)
- TeamViewer Log File Deleted by frack113
- Tomcat WebServer Logs Deleted by Nasreddine Bencherchali (Nextron Systems)
- Unusual File Deletion by Dns.exe by Tim Rauch (Nextron Systems), Elastic (idea)
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Object and data eventsAppendix B item 5(3) | Supports an activity | our analysis: file delete archived |
| OMB M-26-14: Data affectedAppendix B item 5(9) | Supports an activity | our analysis: files deleted after exfiltration |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| Microsoft Defender for Endpoint device tables | DeviceFileEvents | Full | pySigma-backend-kusto: Sysmon EventID 23 (delete) -> DeviceFileEvents |
| Elastic Defend endpoint events | file | Full | Elastic Defend file dataset (deletion events) |