SOC Event Lookup
Event ID 23FileP2

Sysmon Event ID 23: FileDelete (archived)

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 23 records file deletion and archives the deleted file.

Technical Metadata

Technical metadata for Event ID 23
Event ID23
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0005 Defense Evasion / T1070.004 Indicator Removal: File Deletion
Key fields to watchTargetFilename, Image / ProcessGuid, ArchiveDirectory

Trigger Scenarios

Sysmon emits this event when a file is deleted and copy-on-delete archival is configured. Microsoft documents that deleted files are saved under ArchiveDirectory, which defaults to C:\\Sysmon.

Key Fields

TargetFilename

The deleted file path. User-writable paths such as C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, and AppData are common places where staged tools and scripts are removed.

Image / ProcessGuid

Identifies the deleting process and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context.

ArchiveDirectory

Microsoft documents the default archive location as C:\\Sysmon. Retrieve the archived copy before response actions or retention cleanup remove it.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 23
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 23
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 23
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=23
| table _time, host, EventCode, Message
Data source
Splunk Windows Sysmon event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Sysmon Event ID 23
dataset = microsoft_windows_raw
| filter edr_event_id = 23
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Sysmon Event ID 23
title: Sysmon Event ID 23
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 23
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID23A deleted file was logged and archived.Interpret EventID with the full event and correlated activity; this value alone is not proof of compromise. Source
ArchiveDirectoryC:\SysmonThe default protected archive location documented by Sysinternals.Interpret ArchiveDirectory with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1070.004Indicator Removal: File Deletion

Detection Notes

Alert when TargetFilename under C:\\Users\\, C:\\ProgramData\\, C:\\Windows\\Temp, or AppData is deleted by a scripting or command process shortly after tool execution. Microsoft documents Event 23 as FileDelete with an archived copy saved under ArchiveDirectory, defaulting to C:\\Sysmon; that archived copy is the immediate evidence to preserve. This maps to T1070.004 File Deletion when the file is a dropped tool, script, or intrusion artifact; correlate ProcessGuid to Event 1 and retrieve the archived file before containment changes the host.

Common False Positives

  • Approved administration, management agents, and deployment tools can generate this telemetry.
  • Baseline expected hosts, signed binaries, and change windows before suppression.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 01:00:00.000
TargetFilename: C:\\Users\\Public\\stage.exe
Image: C:\\Windows\\System32\\cmd.exe
ProcessGuid: {REDACTED}
ArchiveDirectory: C:\\Sysmon

Frequently Asked Questions

What does Sysmon Event ID 23 mean?

A file was deleted and Sysmon preserved an archived copy.

Does Event ID 23 always indicate malicious activity?

No. Routine cleanup and software updates delete files.

How should Event ID 23 be investigated?

Review TargetFilename and Image, join ProcessGuid to Event 1, and preserve the archived copy for analysis.

Sources

Machine-readable JSON