huntrule

Sysmon FileBlockShredding Policy Violations (Event ID 28) on Windows

Alerts on Sysmon Event ID 28 when file shredding is blocked by the configured shredding policy on Windows.

FreeUnreviewedSigmahighv1
title: Sysmon FileBlockShredding Policy Violations (Event ID 28) on Windows
id: 7b74b37d-aefc-46b6-b425-fd2d97042244
status: test
description: This rule flags any Sysmon event indicating that a file shredding operation was blocked due to the configured shredding policy. Attackers may attempt to evade forensic recovery by shredding or destroying files, making policy enforcement and prevention critical for defense-in-depth. Detection relies on Sysmon process telemetry by matching Windows Sysmon Event ID 28 (FileBlockShredding).
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_file_block_shredding.yml
author: frack113, Huntrule Team
date: 2023-07-20
tags:
  - attack.defense-impairment
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 28
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c3e5c1b1-45e9-4632-b242-27939c170239
    type: derived

What it detects

This rule flags any Sysmon event indicating that a file shredding operation was blocked due to the configured shredding policy. Attackers may attempt to evade forensic recovery by shredding or destroying files, making policy enforcement and prevention critical for defense-in-depth. Detection relies on Sysmon process telemetry by matching Windows Sysmon Event ID 28 (FileBlockShredding).

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.