An object was deleted
An object (file, registry key) was deleted from the filesystem or registry.
Event ID 4660 confirms that an object was deleted. It pairs with Event ID 4656 or 4663 using the unique `Handle ID` to identify exact filenames deleted.
Failure Reason / Root Cause:
File deletion, temporary installer cleanup, or ransomware/attacker deleting logs and shadow copies.
Raw Event XML snippet
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4660</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-07-17T09:54:44.870Z" />
<EventRecordID>1048576</EventRecordID>
<Correlation />
<Execution ProcessID="612" ThreadID="1024" />
<Channel>Security</Channel>
<Computer>DC01.enterprise.internal</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">SYSTEM</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<!-- Event telemetry fields specific to An object was deleted -->
</EventData>
</Event>MITRE ATT&CK mapping
| ID | Technique | Tactic |
|---|---|---|
T1485 | Data Destruction | Impact |
Recommended actions
- Use `Handle ID` correlation with Event ID 4663 to retrieve the path of deleted files during data destruction incidents.