Event ID 23: FileDelete (A file delete was detected)

Version: 4.81

Description

This event logs when a file is deleted by a process.

Data Dictionary

Field Name

Type

Description

Sample Value

RuleName

string

custom tag mapped to event. i.e ATT&CK technique ID

T1114

UtcTime

date

Time in UTC when event was created

2021-10-13T20:06:22.6490000Z

ProcessGuid

string

Process Guid of the process that deleted the file

{A98268C1-959E-5ACD-0000-0010236E0300}

ProcessId

integer

Process ID used by the os to identify the process that deleted the file

1896

Image

string

File path of the process that deleted the file

/lib/systemd/systemd

User

string

Name of the account who deleted the file.

root

TargetFilename

string

full path name of the deleted file

/run/systemd/units/invocation:rsyslog.service

Hashes

string

Hashes captured by sysmon driver of the deleted file

SHA1=B0BF5AC2E81BBF597FAD5F349FEEB32CAC449FA2, MD5=6A255BEBF3DBCD13585538ED47DBAFD7, SHA256=4668BB2223FFB983A5F1273B9E3D9FA2C5CE4A0F1FB18CA5C1B285762020073C, IMPHASH=2505BD03D7BD285E50CE89CEC02B333B

IsExecutable

bool

TBD

TBD

Archived

string

States if the file was archived when deleted

True