Sysmon Event ID 26: FileDeleteDetected
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-22
Quick summary
Sysmon Event ID 26 records file deletion without preserving the deleted file.
Technical Metadata
| Event ID | 26 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0005 Defense Evasion / T1070.004 Indicator Removal: File Deletion |
| Key fields to watch | TargetFilename, Image / ProcessGuid, Hashes / IsExecutable |
Trigger Scenarios
Microsoft documents Event 26 as behavior similar to Event 23 file deletion, but without saving deleted files to the archive directory.
Key Fields
TargetFilename
The deleted file path. Focus on staged tools and scripts under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData.
Image / ProcessGuid
The deleting process and stable join key to Event ID 1.
Hashes / IsExecutable
Public Sysmon field references expose hash and executable indicators that help distinguish payload deletion from routine cleanup.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 26
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=26
| table _time, host, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 26- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
title: Sysmon Event ID 26
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 26
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 26 | A file deletion was detected without archiving the deleted file. | Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
| TargetFilename | file path | The deleted file path used for triage and correlation. | Interpret TargetFilename with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1070.004Indicator Removal: File Deletion
Detection Notes
Alert when TargetFilename under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData is deleted by cmd.exe, powershell.exe, or an unapproved process shortly after Event 11 file creation. Microsoft documents Event 26 as file deletion without archived preservation; MITRE T1070.004 covers deletion of dropped tools and intrusion artifacts. Correlate ProcessGuid to Event 1 and use any Hashes/IsExecutable data before the artifact is lost.
Common False Positives
- Installers, browsers, endpoint agents, and cleanup jobs delete temporary files routinely.
- Unlike Event 23, Event 26 does not preserve the deleted file, so hash and process context matter more.
Related Events
Sample Log
UtcTime: 2026-07-13 03:05:00.000
Image: C:\Windows\System32\cmd.exe
TargetFilename: C:\Windows\Temp\stage.exe
Hashes: SHA256=REDACTED
IsExecutable: true
ProcessGuid: {REDACTED}Frequently Asked Questions
What does Sysmon Event ID 26 mean?
A file was deleted and logged without preserving an archive copy.
Does Event ID 26 always indicate malicious activity?
No. Applications and users delete files continuously.
How should Event ID 26 be investigated?
Review TargetFilename, Image, hashes when available, and ProcessGuid-linked creation and execution activity.
Sources
- 26: FileDeleteDetected
Microsoft Sysinternals · vendor
- Indicator Removal: File Deletion (T1070.004)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule