Digging deeper into file deletions with Sysmon Event ID 26

In our previous blog post, we discussed Sysmon version 13's Event ID 25, which introduced a very handy way of detecting process tampering techniques, particularly process hollowing and process herpaderping in the network. In an update to the Sysmon Event ID 23 (File Deleted) (which was released in an earlier Sysmon package) Sysmon internals has also released a new event ID, i.e., Sysmon Event ID 26 (File Delete Detected) to track file deletions.

In this blog post, we'll focus on understanding Sysmon version 13's Event ID 26 We 'll also cover how it differs from Event ID 23, and how it can help you understand file deletions.

Understanding the difference between Sysmon Event ID 23 and Sysmon Event ID 26.

Earlier, any deleted file was automatically saved to a configured archive directory (C:\Sysmon by default). Archiving deleted files was automatically enabled, and a deleted file event was created under Event ID 23 when you had correctly configured the Sysmon package. The issue with archiving is that a lot of admins didn't want their disk space to be used up by unwanted archived files. The earlier Sysmon releases didn't allow the disabling of file archival. The new Sysmon versions have rectified this issue, and this is why file deletions are treated a little differently under Event ID 26. Sysmon Event ID 26 is logged when the archive directory is disabled and a file is deleted without being archived.

When viewing Event ID 23 in the Event Viewer, you'll notice that the Archived attribute is set as "True", but when Event ID 26 is viewed, the attribute is found missing entirely. Apart from the Archived field, the other information about the deleted file remains the same. With these new separate event IDs at play, you can automate the archival of specific files and folders while disabling it for others, and track them as separate event IDs that are related to file deletions.

How to configure this new event type:

<FileDeleteDetected onmatch="exclude">
<User condition="contains any">NETWORK SERVICE; LOCAL SERVICE</User>
<Image condition="contains all">\appdata\local\google\chrome\user 
data\swreporter\;software_reporter_tool.exe</Image>
<Image condition="is">C:\Program Files 
(x86)\Google\Chrome\Application\chrome.exe</Image>
</FileDeleteDetected>

In your Windows Event Viewer, you can view the following fields related to Event ID 26

You can build a custom report for Sysmon Event ID 26 in Log360, as shown below

Custom report created to track file deletion for Sysmon Event ID 26.