Sysmon 23 — File deletion archived

Sysmon 23 — File deletion archived. Sysmon records file deletion archived through its Windows Operational channel.

Source and collection

Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.

Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — events[2].event.original

Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 4d7c5ae56349329038568f3606ea79fa3532b01dd0095193dbd5382b2c3c7704

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>23</EventID><Version>5</Version><Level>4</Level><Task>23</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2020-05-07T08:14:44.489978500Z'/><EventRecordID>612</EventRecordID><Correlation/><Execution ProcessID='664' ThreadID='2360'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>vagrant-2012-r2</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2020-05-07 08:14:44.489</Data><Data Name='ProcessGuid'>{42f11c3b-c36f-5eb3-2c07-290000000000}</Data><Data Name='ProcessId'>2184</Data><Data Name='User'>VAGRANT-2012-R2\vagrant</Data><Data Name='Image'>C:\Users\vagrant\.gvm\versions\go1.13.10.windows.amd64\bin\go.exe</Data><Data Name='TargetFilename'>C:\Users\vagrant\AppData\Local\Temp\1\go-build583768550\b001\test.test.exe</Data><Data Name='Hashes'>MD5=199E1CF5B2250BD515ECCCF4CA686301,IMPHASH=D90D8C7812AEC8DA0FA173AFA1293AB2</Data><Data Name='IsExecutable'>true</Data><Data Name='Archived'>true</Data></EventData></Event>

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`Microsoft-Windows-Sysmon`	XML text
`EventID`	XML text
`Version`	XML text
`Level`	XML text
`Task`	XML text
`Opcode`	XML text
`Keywords`	XML text
`TimeCreated`	XML text
`EventRecordID`	XML text
`Correlation`	XML text
`Execution`	XML text
`Channel`	XML text
`Computer`	XML text
`Security`	XML text
`RuleName`	XML text
`UtcTime`	XML text
`ProcessGuid`	XML text
`ProcessId`	XML text
`User`	XML text
`Image`	XML text
`TargetFilename`	XML text
`Hashes`	XML text
`IsExecutable`	XML text
`Archived`	XML text

EventID: 23 in Microsoft-Windows-Sysmon.
UtcTime: Producer-supplied event time.
ProcessGuid: Process correlation identifier where present; case-sensitive field names vary by event.
Relevant fields: ProcessGuid, TargetFilename, Hashes, Archived

Investigation uses

Review file deletion with retained artifacts and process history.
Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join.

Validation boundaries

FileDelete behavior and archiving differ from FileDeleteDetected event 26; validate configuration and storage retention.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.