Log Dejargonizer

Sysmon · Event 23

Sysmon Event 23: A file was deleted and archived

A file was deleted, and Sysmon kept a copy. That archiving is what makes it unusual — it can preserve the payload an attacker removed after use, which is often the one artefact that would otherwise be gone for good.

Also written as Sysmon 23Sysmon Event ID 23FileDeletesysmon file delete archived

What it means for you

On a personal computer

Only present if you installed Sysmon. It records files being deleted.

For an analyst

Added in Sysmon 13. The archive directory grows without limit and Sysmon does not manage it for you — filter tightly and rotate it, or you will fill the disk. Scope archiving to executables and scripts in user-writable paths rather than everything. Event 26 records a deletion without archiving, which is the cheaper option when you only need the record.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
File Delete archived:
  RuleName: -
  UtcTime: 2026-08-28 09:22:41.803
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  User: CORP\jbrooks
  Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  TargetFilename: C:\Users\jbrooks\AppData\Local\Temp\wh.exe
  Hashes: SHA256=0000000000000000000000000000000000000000000000000000000000000000
  IsExecutable: true
  Archived: true

The fields that decide it

Everything else in the log line is context.

TargetFilename
The file that was deleted.
Image
The process that deleted it. A shell deleting executables is more interesting than an installer cleaning up.
IsExecutable
Whether the deleted file was executable, which is the main thing worth filtering on.
Archived
Whether Sysmon kept a copy, and where. This is the field that turns the event into evidence.
Hashes
Hashes of the deleted file, usable for reputation lookup even if the archive is gone.
User
The account the deleting process ran under.

Ordinary reasons this happens

Most of the time it is one of these.

  • Ordinary use — deleting files, emptying the recycle bin.
  • Temporary files being cleaned up, which is most of the volume.
  • Software uninstallation and update processes removing old versions.
  • Build tools clearing output directories on developer machines.
  • Browser cache eviction.

When it is not ordinary

Removing a payload after it has run.

What gives it awayAn executable or script deleted from a temp or user directory shortly after being created and executed.

ATT&CK T1070.004

Anti-forensics after an intrusion.

What gives it awayA burst of deletions of tools and logs from one process, often near the end of a session.

ATT&CK T1070

Ransomware removing originals after encrypting them.

What gives it awayVery high deletion volume from one process, alongside heavy file creation with a consistent new extension.

ATT&CK T1485

Clearing staged data after exfiltration.

What gives it awayArchives deleted from a temp directory shortly after a large outbound transfer.

ATT&CK T1070.004

What to do next

  1. Check whether the file was archived, and retrieve the copy before doing anything else — it may be the only surviving sample.
  2. Join on ProcessGuid to Sysmon Event 1 for the deleting process and its command line.
  3. Check Sysmon Event 11 for when the file was created and by what. A short lifespan is the pattern.
  4. Look at the deletion rate. Bursts from one process are worth immediate attention.
  5. Hash the archived file and check it against reputation sources.
  6. Watch the archive directory size — it grows without bound and Sysmon will not manage it.

Queries to run

kql Executable content being deleted. Far more interesting than document deletion. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 23 | where TargetFilename matches regex @'\.(exe|dll|ps1|vbs|js|bat|scr)$' | project TimeGenerated, Computer, Image, TargetFilename, User
kql Files created and deleted within ten minutes — the shape of a payload used and cleaned up. 
let created = Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 11 | project CreateTime = TimeGenerated, Computer, TargetFilename;
let deleted = Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 23 | project DelTime = TimeGenerated, Computer, TargetFilename, Image;
created | join kind=inner deleted on Computer, TargetFilename | where DelTime - CreateTime < 10m
kql Extreme deletion rates, which points at ransomware or bulk destruction. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 23 | summarize deletions = count() by Image, Computer, bin(TimeGenerated, 1m) | where deletions > 200

Common questions

Where does Sysmon store archived deleted files?

In the directory set by the ArchiveDirectory option in your configuration, C:\Sysmon by default. The folder is protected by a System ACL. It grows without limit and Sysmon does not clean it up, so filter what gets archived and rotate the directory yourself — filling the system drive is a real and common outcome.

What is the difference between Sysmon Event 23 and Event 26?

Event 23 is a deletion where Sysmon archived a copy of the file. Event 26 is a deletion it detected but did not archive. Use 26 when you only need to know something was deleted, and 23 for the paths where you would actually want the file back.

Can Sysmon recover a file an attacker deleted?

If archiving was enabled for that path, yes — the copy in the archive directory is the file as it existed. That is genuinely valuable, because deleting the payload after use is standard practice and it is often the only sample that would have existed. It only works if you configured archiving before the incident.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026