Sysmon Event ID 23: FileDelete (archived)
Sysmon Event ID 23 records file deletion and archives the deleted file.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Sysmon emits this event when a file is deleted and copy-on-delete archival is configured. Microsoft documents that deleted files are saved under ArchiveDirectory, which defaults to C:\\Sysmon.
Key Fields
TargetFilename
The deleted file path. User-writable paths such as C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, and AppData are common places where staged tools and scripts are removed.
Image / ProcessGuid
Identifies the deleting process and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context.
ArchiveDirectory
Microsoft documents the default archive location as C:\\Sysmon. Retrieve the archived copy before response actions or retention cleanup remove it.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
MITRE ATT&CK Mapping
- T1070.004Indicator Removal: File Deletion
Detection Notes
Alert when TargetFilename under C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, or AppData is deleted by a scripting or command process shortly after tool execution. Microsoft documents Event 23 as FileDelete with an archived copy saved under ArchiveDirectory, defaulting to C:\\Sysmon; that archived copy is the immediate evidence to preserve. This maps to T1070.004 File Deletion when the file is a dropped tool, script, or intrusion artifact; correlate ProcessGuid to Event 1 and retrieve the archived file before containment changes the host.
Sysmon
| where EventID == 23
| project TimeGenerated, Computer, Image, ProcessGuidindex=sysmon EventCode=23 | table _time, host, Image, ProcessGuidUtcTime: 2026-07-13 01:00:00.000
TargetFilename: C:\\Users\\Public\\stage.exe
Image: C:\\Windows\\System32\\cmd.exe
ProcessGuid: {REDACTED}
ArchiveDirectory: C:\\Sysmon