Sysmon Event ID 26 — File delete logged (not archived) — SecOps Tools

Why event 26 matters

Same as Sysmon 23 but without archiving. Useful when archiving is disabled. Attack cleanup detection.

How to detect it

Same as Sysmon 23. Alert: recently created malicious files being deleted.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Defense Evasion	Indicator Removal: File Deletion (T1070.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 26   // File delete logged (not archived)
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=26
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# File delete logged (not archived) — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 26 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 26?

File delete logged (not archived). A file was deleted (logged but not archived by Sysmon — archive disabled or file too large).

Which log records event 26?

Event 26 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 26?

Event 26 is associated with: Indicator Removal: File Deletion (T1070.004).

How do you detect activity around event 26?

Same as Sysmon 23. Alert: recently created malicious files being deleted.