Sysmon Event ID 28 — File block shredding — SecOps Tools

Why event 28 matters

Attacker attempting to securely wipe evidence of their tools or activity. Secure deletion tools (sdelete, cipher /w) leave no forensic artifacts — this event blocks and records the attempt.

How to detect it

Alert on occurrences from unexpected processes. Secure file deletion by attackers = evidence of malicious intent.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Defense Evasion	Indicator Removal: File Deletion (T1070.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 28   // File block shredding
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=28
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# File block shredding — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 28 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 28?

File block shredding. Sysmon blocked a file shredding operation (secure deletion of evidence).

Which log records event 28?

Event 28 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 28?

Event 28 is associated with: Indicator Removal: File Deletion (T1070.004).

How do you detect activity around event 28?

Alert on occurrences from unexpected processes. Secure file deletion by attackers = evidence of malicious intent.