Event ID 23: FileDelete (A file delete was detected)
Contents
Event ID 23: FileDelete (A file delete was detected)¶
Version: 4.81¶
Description¶
This event logs when a file is deleted by a process.
Data Dictionary¶
Field Name |
Type |
Description |
Sample Value |
|---|---|---|---|
RuleName |
string |
custom tag mapped to event. i.e ATT&CK technique ID |
|
UtcTime |
date |
Time in UTC when event was created |
|
ProcessGuid |
string |
Process Guid of the process that deleted the file |
|
ProcessId |
integer |
Process ID used by the os to identify the process that deleted the file |
|
Image |
string |
File path of the process that deleted the file |
|
User |
string |
Name of the account who deleted the file. |
|
TargetFilename |
string |
full path name of the deleted file |
|
Hashes |
string |
Hashes captured by sysmon driver of the deleted file |
|
IsExecutable |
bool |
TBD |
|
Archived |
string |
States if the file was archived when deleted |
|