Detectionhightest

Sysmon Blocked File Shredding

Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François HubautCreated Thu Jul 20c3e5c1b1-45e9-4632-b242-27939c170239windows

Log Source

Windowssysmon

ProductWindows← raw: windows

Servicesysmon← raw: sysmon

Detection Logic

detection:
    selection:
        EventID: 28  # this is fine, we want to match any FileBlockShredding event
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

c3e5c1b1-45e9-4632-b242-27939c170239

Status

test

Level

high

Type

Detection

Created

Thu Jul 20

Author

Path

rules/windows/sysmon/sysmon_file_block_shredding.yml

Raw Tags

attack.defense-evasion