File deletion events - Microsoft Servers

[jabbath3hutt]

Hi Guys,

I have come across multiple requests for the monitoring of file deletions on critical systems (MS to start with) and network shares.

Following the recommendations as per the MS articles (remote deletion in this case), can anyone make any more recommendations to improve the usefullness in ESM?

MS Link : https://blogs.technet.microsoft.com/askds/2009/08/04/tracking-a-remote-file-deletion-back-to-the-sou...

- Events show in ESM, but only the process that deletes the file is listed, not the filename and location (see below)

- Event in Windows does show the filename and location (in event 4663)

- We have removed aggregation on the events temporarily to see if more information is gathered, but no luck there...

I would love to hear any solutions to the issue. Would also be helpful if there are some correlation work on Remote File Deletion (from shares), and atribution to a user/Host.

Regards

JaBBa

One update... I think this is a WMI parsing limitation, so a PER might be my only answer...

Message was edited by: Jan vd Merwe

[Former Member]

Hello,

Try is : Disable the filter rule i.e The windows filtering platform..and ON the aggregation.

>>>>>David

[Former Member]

Looking at Windows Event 4656  (A handle to an object was requested) I believe destination_filename in custom types gives that information.  I am on the latest version.

[jabbath3hutt]

Hi rgarrett.

Thanks for this, I also se these fields in my ESM on event 4656. They do not however appear so complete in the event 4663...

Looking at the packet, this information also does not appear threre. I am thinking this might be an issue with the WMI parser for this event.

It would seem that the "Object" field was populated with the same information as the Process/Application field. In the event on the Server, the filname is listed as "Object_Name" so I am thinking this is a parsing issue...

Regards

Jan