Sysmon FileBlockShredding Policy Violations (Event ID 28) on Windows
Alerts on Sysmon Event ID 28 when file shredding is blocked by the configured shredding policy on Windows.
FreeReviewedSigma · High · v1
- Product
- windows
- Service
- sysmon
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-07-20
- Updated
- 2026-07-30
What it detects
This rule flags any Sysmon event indicating that a file shredding operation was blocked due to the configured shredding policy. Attackers may attempt to evade forensic recovery by shredding or destroying files, making policy enforcement and prevention critical for defense-in-depth. Detection relies on Sysmon process telemetry by matching Windows Sysmon Event ID 28 (FileBlockShredding).
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
sysmon-fileblockshredding-policy-violations-event-id-28-on-windows-c3e5c1b1
title: Sysmon FileBlockShredding Policy Violations (Event ID 28) on Windows
id: 7b74b37d-aefc-46b6-b425-fd2d97042244
status: test
description: This rule flags any Sysmon event indicating that a file shredding operation was blocked due to the configured shredding policy. Attackers may attempt to evade forensic recovery by shredding or destroying files, making policy enforcement and prevention critical for defense-in-depth. Detection relies on Sysmon process telemetry by matching Windows Sysmon Event ID 28 (FileBlockShredding).
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_file_block_shredding.yml
author: frack113, Huntrule Team
date: 2023-07-20
tags:
- attack.defense-impairment
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 28
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: c3e5c1b1-45e9-4632-b242-27939c170239
type: derived