Mass file deletion
A single process deleted a large number of files in a short window (Sysmon FileDelete, Event ID 23/26).
What it detects
A single process deleted a large number of files in a short window (Sysmon FileDelete, Event ID 23/26). This is the shape of destructive impact — ransomware deleting originals or shadow copies, a wiper, or anti-forensics erasing evidence — where one process churns through the filesystem far faster than ordinary use. Realises a catalogued behaviour (rapid bulk file deletions) via the rule engine's burst correlation.
MITRE ATT&CK mapping
False positives and triage
Uninstallers, build/CI tooling, cache-cleanup utilities, and backup rotation also delete many files quickly. The strong signal is a burst from an UNUSUAL process (a script host, an unsigned binary, a process in a user-writable path), deletions of documents/backups rather than temp/build artifacts, or deletions paired with shadow-copy removal or a ransom note. Confirm the deleting process and what was deleted; allow-list known cleanup tooling.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/windows/mass_file_deletion.yaml, licensed under the Apache License 2.0.
id: windows.impact.mass_file_deletion
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [windows]
mitre_techniques: [T1485, T1070.004]
description: |
A single process deleted a large number of files in a short window (Sysmon FileDelete,
Event ID 23/26). This is the shape of destructive impact — ransomware deleting originals
or shadow copies, a wiper, or anti-forensics erasing evidence — where one process churns
through the filesystem far faster than ordinary use. Realises behavioural catalog BEH-024
(rapid bulk file deletions) via the rule engine's burst correlation.
match:
event_action: file_deleted
threshold:
count: 20
window_seconds: 60
group_by: [process_name]
correlation_keys: [process_name, hostname]
false_positive_guidance: |
Uninstallers, build/CI tooling, cache-cleanup utilities, and backup rotation also delete
many files quickly. The strong signal is a burst from an UNUSUAL process (a script host,
an unsigned binary, a process in a user-writable path), deletions of documents/backups
rather than temp/build artifacts, or deletions paired with shadow-copy removal or a ransom
note. Confirm the deleting process and what was deleted; allow-list known cleanup tooling.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.