Event ID 1
Process creation
ProcessSysmon
High-priority SOC reference for process execution and lifecycle analysis.
Open event guide
Sysmon Event IDs
Browse complete Sysmon event guides by category, with investigation context, key fields, false positives, ATT&CK mappings, KQL, and SPL.
30 events found
P1
Event ID 2
A process changed a file creation time
FileSysmon
Priority SOC reference for file creation, deletion, and executable staging review.
Open event guide
Event ID 3
Network connection detected
NetworkSysmon
High-priority SOC reference for network visibility and connection triage.
Open event guide
Event ID 4
Sysmon service state changed
ServiceSysmon
Specialized SOC reference for service state and operational integrity review.
Open event guide
Event ID 5
Process terminated
ProcessSysmon
Priority SOC reference for process execution and lifecycle analysis.
Open event guide
Event ID 6
Driver loaded
DriverSysmon
Priority SOC reference for kernel driver and code-loading review.
Open event guide
Event ID 7
Image loaded (DLL/EXE)
ImageSysmon
Priority SOC reference for DLL loading, side-loading, and library abuse review.
Open event guide
Event ID 8
CreateRemoteThread
ProcessSysmon
High-priority SOC reference for process execution and lifecycle analysis.
Open event guide
Event ID 9
RawAccessRead
DiskSysmon
Specialized SOC reference for raw disk access and anti-forensics review.
Open event guide
Event ID 10
ProcessAccess
ProcessSysmon
High-priority SOC reference for process execution and lifecycle analysis.
Open event guide
Event ID 11
FileCreate
FileSysmon
High-priority SOC reference for file creation, deletion, and executable staging review.
Open event guide
Event ID 12
RegistryEvent (Object create/delete)
RegistrySysmon
Priority SOC reference for registry persistence and configuration-change review.
Open event guide
Event ID 13
RegistryEvent (Value Set)
RegistrySysmon
Priority SOC reference for registry persistence and configuration-change review.
Open event guide
Event ID 14
RegistryEvent (Key/Value Rename)
RegistrySysmon
Specialized SOC reference for registry persistence and configuration-change review.
Open event guide
Event ID 15
FileCreateStreamHash
FileSysmon
Specialized SOC reference for file creation, deletion, and executable staging review.
Open event guide
Event ID 16
ServiceConfigurationChange (Sysmon config change)
ConfigSysmon
Priority SOC reference for security telemetry configuration review.
Open event guide
Event ID 17
PipeEvent - Pipe Created
PipeSysmon
Priority SOC reference for named-pipe lateral movement and IPC review.
Open event guide
Event ID 18
PipeEvent - Pipe Connected
PipeSysmon
Priority SOC reference for named-pipe lateral movement and IPC review.
Open event guide
Event ID 19
WmiEvent - WmiEventFilter activity detected
WMISysmon
Priority SOC reference for WMI persistence and event-subscription review.
Open event guide
Event ID 20
WmiEvent - WmiEventConsumer activity detected
WMISysmon
Priority SOC reference for WMI persistence and event-subscription review.
Open event guide
Event ID 21
WmiEvent - WmiEventConsumerToFilter activity detected
WMISysmon
Priority SOC reference for WMI persistence and event-subscription review.
Open event guide
Event ID 22
DNSEvent (DNS query)
NetworkSysmon
High-priority SOC reference for network visibility and connection triage.
Open event guide
Event ID 23
FileDelete (archived)
FileSysmon
Priority SOC reference for file creation, deletion, and executable staging review.
Open event guide
Event ID 24
ClipboardChange
ClipboardSysmon
Specialized SOC reference for clipboard activity and potential data exposure review.
Open event guide
Event ID 25
ProcessTampering
ProcessSysmon
Priority SOC reference for process execution and lifecycle analysis.
Open event guide
Event ID 26
FileDeleteDetected
FileSysmon
Specialized SOC reference for file creation, deletion, and executable staging review.
Open event guide
Event ID 27
FileBlockExecutable
FileSysmon
Specialized SOC reference for file creation, deletion, and executable staging review.
Open event guide
Event ID 28
FileBlockShredding
FileSysmon
Specialized SOC reference for file creation, deletion, and executable staging review.
Open event guide
Event ID 29
FileExecutableDetected
FileSysmon
Priority SOC reference for file creation, deletion, and executable staging review.
Open event guide
Event ID 255
Sysmon service error report
ErrorSysmon
Specialized SOC reference for telemetry health and troubleshooting review.
Open event guide