Event ID 23 — FileDelete (File Delete archived)

Provider: Microsoft-Windows-Sysmon
Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: File Delete archived (rule: FileDelete)
Opcode: Info

Description

A file was deleted. Additionally the deleted file is saved in the ArchiveDirectory.

Message #

File Delete archived:
RuleName: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
User: %5
Image: %6
TargetFilename: %7
Hashes: %8
IsExecutable: %9
Archived: %10

Fields #

Name	Description
`RuleName` UnicodeString → string	Custom tag mapped to event, i.e. ATT&CK technique ID
`UtcTime` UnicodeString → string	Time in UTC when event was created
`ProcessGuid` GUID → GUID	Process GUID of the process that deleted the file
`ProcessId` UInt32 → PID	Process ID used by the OS to identify the process that deleted the file
`User` UnicodeString → string	Name of the account who deleted the file.
`Image` UnicodeString → string	File path of the process that deleted the file
`TargetFilename` UnicodeString → string	Full path name of the deleted file
`Hashes` UnicodeString → string	Hashes captured by the Sysmon driver of the deleted file
`IsExecutable` Boolean → boolean	Whether the deleted file is a PE executable
`Archived` UnicodeString → string	States if the file was archived when deleted

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 23,
    "version": 5,
    "level": 4,
    "task": 23,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2020-10-20T11:50:55.461859Z",
    "event_record_id": 769,
    "correlation": {},
    "execution": {
      "process_id": 7212,
      "thread_id": 9748
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "DESKTOP-NTSSLJD",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2020-10-20 11:50:55.457",
    "ProcessGuid": "23F38D93-CF1F-5F8E-CA08-000000000C00",
    "ProcessId": 8736,
    "User": "DESKTOP-NTSSLJD\\den",
    "Image": "C:\\Program Files\\Internet Explorer\\IEInstal.exe",
    "TargetFilename": "C:\\Users\\den\\AppData\\Local\\Temp\\dfcc1807-03a1-4ae1-ab29-5675b285edea\\consent.exe.dat",
    "Hashes": "SHA1=6BFB38629570909D3D9EEDFC783A948CE7849105,MD5=EE2A1C85C472F89B146CC8EE598CCCBC,SHA256=19FD0010DA92B654D1CA270247061A39EA13C0A58529FD8257A97E2EF7794911,IMPHASH=522D83761201075834F05037F5307949",
    "IsExecutable": true,
    "Archived": "true"
  }
}

Detection Patterns #

Sysmon Event ID 23: FileDeleteANDEvent ID 26: FileDeleteDetected

15 rules

Sigma

EventLog EVTX File Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Exchange PowerShell Cmdlet History Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

IIS WebServer Access Logs Deleted (source)

Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Show 6 more (9 total)

PowerShell Console History Logs Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Tomcat WebServer Logs Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Prefetch File Deleted (source)

Cedric MAURUGEON

TeamViewer Log File Deleted (source)

frack113

File Deleted Via Sysinternals SDelete (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

ADS Zone.Identifier Deleted By Uncommon Application (source)

Nasreddine Bencherchali (Nextron Systems)

Splunk

Windows ConsoleHost History File Deletion (source)

Teoderick Contreras, Splunk

Windows Default Rdp File Deletion (source)

Teoderick Contreras, Splunk

Windows RDP Cache File Deletion (source)

Teoderick Contreras, Splunk

Show 3 more (6 total)

Excessive File Deletion In WinDefender Folder (source)

Teoderick Contreras, Splunk, Steven Dick

Windows Data Destruction Recursive Exec Files Deletion (source)

Teoderick Contreras, Splunk, Steven Dick

Windows High File Deletion Frequency (source)

Teoderick Contreras, Splunk, Steven Dick

Sysmon Event ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

14 rules

Sigma

Unusual File Deletion by Dns.exe (source)

Tim Rauch (Nextron Systems), Elastic (idea)

EventLog EVTX File Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Exchange PowerShell Cmdlet History Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Show 8 more (11 total)

IIS WebServer Access Logs Deleted (source)

Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

PowerShell Console History Logs Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

Prefetch File Deleted (source)

Cedric MAURUGEON

TeamViewer Log File Deleted (source)

frack113

Tomcat WebServer Logs Deleted (source)

Nasreddine Bencherchali (Nextron Systems)

File Deleted Via Sysinternals SDelete (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

ADS Zone.Identifier Deleted By Uncommon Application (source)

Nasreddine Bencherchali (Nextron Systems)

Backup Files Deleted (source)

frack113

Splunk

Windows ConsoleHost History File Deletion (source)

Teoderick Contreras, Splunk

Windows Default Rdp File Deletion (source)

Teoderick Contreras, Splunk

Windows RDP Cache File Deletion (source)

Teoderick Contreras, Splunk

Sunburst And Supernova Backdoor

Security-Auditing Event ID 4663: An attempt was made to access an object.ORSysmon Event ID 11: FileCreateOREvent ID 23: FileDeleteOREvent ID 26: FileDeleteDetected

4 rules

Kusto Query Language

SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) (source)

Yaron

SUNBURST and SUPERNOVA backdoor hashes (source)

Google Threat Intelligence - Threat Hunting Hash (source)

Show 1 more (4 total)

RecordedFuture Threat Hunting Hash All Actors (source)

Sunburst And Supernova Backdoor

Security-Auditing Event ID 4663: An attempt was made to access an object.→Sysmon Event ID 11: FileCreate→Event ID 23: FileDelete→Event ID 26: FileDeleteDetected

4 rules

Kusto Query Language

SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) (source)

Yaron

Google Threat Intelligence - Threat Hunting Hash (source)

SUNBURST and SUPERNOVA backdoor hashes (source)

Show 1 more (4 total)

RecordedFuture Threat Hunting Hash All Actors (source)

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

Process Deletion of Its Own Executable source medium: Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.↳ also matches:Event ID 26: FileDeleteDetected (File Delete logged)

Splunk # view in reference

Windows Mark Of The Web Bypass source: The following analytic identifies a suspicious process that deletes the Mark-of-the-Web (MOTW) data stream. It leverages Sysmon EventCode 23 to detect when a file's Zone.Identifier stream is removed. This activity is significant because it is a common technique used by malware, such as Ave Maria RAT, to bypass security restrictions on files downloaded from the internet. If confirmed malicious, this behavior could allow an attacker to execute potentially harmful files without triggering security warnings, leading to further compromise of the system.
Windows Rdp AutomaticDestinations Deletion source: This detection identifies the deletion of files within the AutomaticDestinations folder, located under a user’s AppData\Roaming\Microsoft\Windows\Recent directory. These files are part of the Windows Jump List feature, which records recently accessed files and folders tied to specific applications. Each .automaticDestinations-ms file corresponds to a program (e.g., Explorer, Word, Notepad) and can be valuable for forensic analysis of user activity. Adversaries may target this folder to erase evidence of their actions, such as which documents or directories were accessed during a session. This type of deletion is rarely seen during normal user activity and may indicate deliberate anti-forensic behavior. When correlated with suspicious logon events, RDP usage, or script execution, this activity may represent an attempt to cover tracks after data access, lateral movement, or staging for exfiltration. Detecting removal of these artifacts can highlight post-compromise cleanup efforts and help analysts reconstruct attacker behavior.↳ also matches:Event ID 26: FileDeleteDetected (File Delete logged)

References #

Microsoft Learn https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-23-filedelete-file-delete-archived
Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
OSSEM-DD https://github.com/OTRF/OSSEM-DD/blob/main/windows/sysmon/events/event-23.yml