Sysmon Event ID 28: FileBlockShredding
Sysmon Event ID 28 records that Sysmon detected and blocked file shredding behavior.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that this event is generated when Sysmon detects and blocks file shredding from tools such as SDelete.
Key Fields
TargetFilename
The file targeted for shredding. Prioritize logs, tools, archives, and payloads in user-writable or temporary paths.
Image / ProcessGuid
The process that attempted shredding and the join key to Event ID 1.
Hashes
Hash values, when present, support triage of the file targeted for destruction.
Common False Positives
- Approved secure-delete tools may be used by administrators under documented data-handling procedures.
- Privacy tools and backup cleanup jobs can shred files during normal operations.
Related Events
MITRE ATT&CK Mapping
- T1070.004Indicator Removal: File Deletion
Detection Notes
Alert when TargetFilename is under C:\Users\, C:\ProgramData\, C:\Windows\Temp, or AppData and Image resembles SDelete or an unapproved secure-delete binary. Microsoft documents Event 28 as blocked file shredding from tools such as SDelete; this supports T1070.004 File Deletion when an actor attempts to remove intrusion artifacts or evidence. Correlate ProcessGuid to Event 1 and retrieve related Event 23 archives or backups immediately.
Sysmon
| where EventID == 28
| project TimeGenerated, Computer, Image, TargetFilename, Hashes, ProcessGuidindex=sysmon EventCode=28 | table _time, host, Image, TargetFilename, Hashes, ProcessGuidUtcTime: 2026-07-13 03:07:00.000
Image: C:\Users\Public\sdelete.exe
TargetFilename: C:\Users\Public\loot.zip
Hashes: SHA256=REDACTED
ProcessGuid: {REDACTED}