SOC Event Lookup
Event ID 26FileP3

Sysmon Event ID 26: FileDeleteDetected

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 26 records file deletion without preserving the deleted file.

Technical Metadata

Technical metadata for Event ID 26
Event ID26
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0005 Defense Evasion / T1070.004 Indicator Removal: File Deletion
Key fields to watchTargetFilename, Image / ProcessGuid, Hashes / IsExecutable

Trigger Scenarios

Microsoft documents Event 26 as behavior similar to Event 23 file deletion, but without saving deleted files to the archive directory.

Key Fields

TargetFilename

The deleted file path. Focus on staged tools and scripts under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData.

Image / ProcessGuid

The deleting process and stable join key to Event ID 1.

Hashes / IsExecutable

Public Sysmon field references expose hash and executable indicators that help distinguish payload deletion from routine cleanup.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 26
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 26
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 26
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=26
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 26
dataset = microsoft_windows_raw
| filter edr_event_id = 26
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 26
title: Sysmon Event ID 26
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 26
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID26A file deletion was detected without archiving the deleted file.Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source
TargetFilenamefile pathThe deleted file path used for triage and correlation.Interpret TargetFilename with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1070.004Indicator Removal: File Deletion

Detection Notes

Alert when TargetFilename under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData is deleted by cmd.exe, powershell.exe, or an unapproved process shortly after Event 11 file creation. Microsoft documents Event 26 as file deletion without archived preservation; MITRE T1070.004 covers deletion of dropped tools and intrusion artifacts. Correlate ProcessGuid to Event 1 and use any Hashes/IsExecutable data before the artifact is lost.

Common False Positives

  • Installers, browsers, endpoint agents, and cleanup jobs delete temporary files routinely.
  • Unlike Event 23, Event 26 does not preserve the deleted file, so hash and process context matter more.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 03:05:00.000
Image: C:\Windows\System32\cmd.exe
TargetFilename: C:\Windows\Temp\stage.exe
Hashes: SHA256=REDACTED
IsExecutable: true
ProcessGuid: {REDACTED}

Frequently Asked Questions

What does Sysmon Event ID 26 mean?

A file was deleted and logged without preserving an archive copy.

Does Event ID 26 always indicate malicious activity?

No. Applications and users delete files continuously.

How should Event ID 26 be investigated?

Review TargetFilename, Image, hashes when available, and ProcessGuid-linked creation and execution activity.

Sources

Machine-readable JSON