[sysmon] can i logging deleted all file through sysmon?

holollollol 86 Reputation points
2021-10-07T08:46:26.923+00:00

Hi

I'm Trying logging deleted all file through sysmon.

I used this sysmon config xml and latest sysmon.exe

--------------------
sysmon config------------------------
<Sysmon schemaversion="4.70">
<DnsLookup>False</DnsLookup>
<EventFiltering>
<FileDeleteDetected onmatch="exclude">
</FileDeleteDetected>
</EventFiltering>
</Sysmon>

------------------------------------------------------------

I think If deleted any file, logging event id 26 include deleted file.

But, event ID 26 not logging after delete any path directory, file.

Only the following two are logged repeatedly.
138453-26.png

I don want this target file name

how can I logging deleted all file through sysmon?

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,607 questions
Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,434 questions
Windows Server 2012
Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,570 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,620 questions
Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,130 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Niklas Sjögren 41 Reputation points
    2021-10-07T09:45:46.26+00:00

    Hi!

    Evt 26 needs config to start logging.. (default = none)

    Try this as include rule
    <RuleGroup name="Evt_26_inc" groupRelation="or">
    <FileDeleteDetected onmatch="include">
    <TargetFilename condition="contains">\</TargetFilename>
    </FileDeleteDetected>
    </RuleGroup>

    You will need to exclude whatever you do not like to see..

    ex.
    <RuleGroup name="Evt_26_exc" groupRelation="or">
    <FileDeleteDetected onmatch="exclude">
    <Rule groupRelation="and">
    <Image condition="begin with">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Image>
    <TargetFilename condition="contains all">C:\Users\;\AppData\Local\Temp__PSScriptPolicyTest</TargetFilename>
    </Rule>
    </FileDeleteDetected>
    </RuleGroup>


  2. Limitless Technology 39,511 Reputation points
    2021-10-07T18:32:13.303+00:00

    Hello @holollollol

    You may need to run a Startup task to run sysmon with the system, like: > Sysmon.exe -i config.xml -a sysmondelete

    Other usage of Sysmon: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

    Hope this helps with your query,

    --------------

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments No comments