[sysmon] can i logging deleted all file through sysmon?

holollollol 86 Reputation points
2021-10-07T08:46:26.923+00:00

Hi

I'm Trying logging deleted all file through sysmon.

I used this sysmon config xml and latest sysmon.exe

--------------------
sysmon config------------------------
<Sysmon schemaversion="4.70">
<DnsLookup>False</DnsLookup>
<EventFiltering>
<FileDeleteDetected onmatch="exclude">
</FileDeleteDetected>
</EventFiltering>
</Sysmon>

------------------------------------------------------------

I think If deleted any file, logging event id 26 include deleted file.

But, event ID 26 not logging after delete any path directory, file.

Only the following two are logged repeatedly.
138453-26.png

I don want this target file name

how can I logging deleted all file through sysmon?

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,245 questions
Windows for business | Windows Server | User experience | Other
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Niklas Sjögren 46 Reputation points
    2021-10-07T09:45:46.26+00:00

    Hi!

    Evt 26 needs config to start logging.. (default = none)

    Try this as include rule
    <RuleGroup name="Evt_26_inc" groupRelation="or">
    <FileDeleteDetected onmatch="include">
    <TargetFilename condition="contains">\</TargetFilename>
    </FileDeleteDetected>
    </RuleGroup>

    You will need to exclude whatever you do not like to see..

    ex.
    <RuleGroup name="Evt_26_exc" groupRelation="or">
    <FileDeleteDetected onmatch="exclude">
    <Rule groupRelation="and">
    <Image condition="begin with">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Image>
    <TargetFilename condition="contains all">C:\Users\;\AppData\Local\Temp__PSScriptPolicyTest</TargetFilename>
    </Rule>
    </FileDeleteDetected>
    </RuleGroup>


  2. Limitless Technology 39,926 Reputation points
    2021-10-07T18:32:13.303+00:00

    Hello @holollollol

    You may need to run a Startup task to run sysmon with the system, like: > Sysmon.exe -i config.xml -a sysmondelete

    Other usage of Sysmon: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

    Hope this helps with your query,

    --------------

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.