23 Sysmon log · FileDelete medium severity medium volume

Sysmon Event ID 23 — File deleted (archived)

A file was deleted and archived by Sysmon. TargetFilename, Image, Archived (whether Sysmon archived a copy) are key.

Why event 23 matters

Attack tool or payload cleanup — attacker deletes their tools after use. Ransomware deleting shadow copies. Malware self-deleting after execution. Sysmon can archive deleted files for forensic recovery.

How to detect it

Alert: deletion of recently created executables or scripts. Alert: deletion from startup folders or service directories after brief existence. Correlate with Sysmon 1 (process create) → Sysmon 23 (file delete) sequence.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Indicator Removal: File Deletion (T1070.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 23   // File deleted (archived)
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=23
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# File deleted (archived) — add EventData fields: Image, CommandLine, ParentImage, User`
Hunt event 23 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 23?

File deleted (archived). A file was deleted and archived by Sysmon. TargetFilename, Image, Archived (whether Sysmon archived a copy) are key.

Which log records event 23?

Event 23 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 23?

Event 23 is associated with: Indicator Removal: File Deletion (T1070.004).

How do you detect activity around event 23?

Alert: deletion of recently created executables or scripts. Alert: deletion from startup folders or service directories after brief existence. Correlate with Sysmon 1 (process create) → Sysmon 23 (file delete) sequence.