SOC Event Lookup
Event ID 28FileP3

Sysmon Event ID 28: FileBlockShredding

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 28 records that Sysmon detected and blocked file shredding behavior.

Technical Metadata

Technical metadata for Event ID 28
Event ID28
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0005 Defense Evasion / T1070.004 Indicator Removal: File Deletion
Key fields to watchTargetFilename, Image / ProcessGuid, Hashes

Trigger Scenarios

Microsoft documents that this event is generated when Sysmon detects and blocks file shredding from tools such as SDelete.

Key Fields

TargetFilename

The file targeted for shredding. Prioritize logs, tools, archives, and payloads in user-writable or temporary paths.

Image / ProcessGuid

The process that attempted shredding and the join key to Event ID 1.

Hashes

Hash values, when present, support triage of the file targeted for destruction.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 28
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 28
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 28
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=28
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 28
dataset = microsoft_windows_raw
| filter edr_event_id = 28
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 28
title: Sysmon Event ID 28
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 28
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID28Sysmon detected and blocked file shredding.Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source
ImageSDeleteSysinternals names SDelete as an example shredding tool, not the only possible source.Interpret Image with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1070.004Indicator Removal: File Deletion

Detection Notes

Alert when TargetFilename is under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData and Image resembles SDelete or an unapproved secure-delete binary. Microsoft documents Event 28 as blocked file shredding from tools such as SDelete; this supports T1070.004 File Deletion when an actor attempts to remove intrusion artifacts or evidence. Correlate ProcessGuid to Event 1 and retrieve related Event 23 archives or backups immediately.

Common False Positives

  • Approved secure-delete tools may be used by administrators under documented data-handling procedures.
  • Privacy tools and backup cleanup jobs can shred files during normal operations.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 03:07:00.000
Image: C:\Users\Public\sdelete.exe
TargetFilename: C:\Users\Public\loot.zip
Hashes: SHA256=REDACTED
ProcessGuid: {REDACTED}

Frequently Asked Questions

What does Sysmon Event ID 28 mean?

Sysmon blocked an attempted file-shredding operation.

Does Event ID 28 always indicate malicious activity?

No. Approved secure-deletion workflows can invoke shredding tools.

How should Event ID 28 be investigated?

Review Image, TargetFilename, ProcessGuid, user context, and whether the deleted material relates to an investigation.

Sources

Machine-readable JSON