All Detections

Sysmon Blocked File Shredding

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.

Sigma