Sysmon Event ID 26: FileDeleteDetected
Sysmon Event ID 26 records file deletion without preserving the deleted file.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents Event 26 as behavior similar to Event 23 file deletion, but without saving deleted files to the archive directory.
Key Fields
TargetFilename
The deleted file path. Focus on staged tools and scripts under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData.
Image / ProcessGuid
The deleting process and stable join key to Event ID 1.
Hashes / IsExecutable
Public Sysmon field references expose hash and executable indicators that help distinguish payload deletion from routine cleanup.
Common False Positives
- Installers, browsers, endpoint agents, and cleanup jobs delete temporary files routinely.
- Unlike Event 23, Event 26 does not preserve the deleted file, so hash and process context matter more.
Related Events
MITRE ATT&CK Mapping
- T1070.004Indicator Removal: File Deletion
Detection Notes
Alert when TargetFilename under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData is deleted by cmd.exe, powershell.exe, or an unapproved process shortly after Event 11 file creation. Microsoft documents Event 26 as file deletion without archived preservation; MITRE T1070.004 covers deletion of dropped tools and intrusion artifacts. Correlate ProcessGuid to Event 1 and use any Hashes/IsExecutable data before the artifact is lost.
Sysmon
| where EventID == 26
| project TimeGenerated, Computer, Image, TargetFilename, Hashes, ProcessGuidindex=sysmon EventCode=26 | table _time, host, Image, TargetFilename, Hashes, ProcessGuidUtcTime: 2026-07-13 03:05:00.000
Image: C:\Windows\System32\cmd.exe
TargetFilename: C:\Windows\Temp\stage.exe
Hashes: SHA256=REDACTED
IsExecutable: true
ProcessGuid: {REDACTED}