Sysmon Event ID 16: ServiceConfigurationChange (Sysmon config change)
Sysmon Event ID 16 records changes to the active Sysmon configuration.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Sysmon emits this event when the service configuration changes, including when filtering rules are updated. Microsoft documents Sysmon configuration entries such as ArchiveDirectory, HashAlgorithms, DnsLookup, CopyOnDeletePE, and event-filtering include/exclude rules.
Key Fields
Configuration state
Review the recorded configuration change against the approved Sysmon XML baseline. Changes to HashAlgorithms, ArchiveDirectory, CopyOnDeletePE, or event filters can materially change telemetry coverage.
EventFiltering
Microsoft documents include/exclude filter tags such as ProcessCreate, NetworkConnect, DriverLoad, ImageLoad, PipeEvent, and RegistryEvent. Removing coverage or adding broad exclusions can blind detection.
UtcTime
Use the configuration-change time to correlate with service-control events, file changes, and process creation from administrators or deployment tools.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
MITRE ATT&CK Mapping
- T1562.001Impair Defenses: Disable or Modify Tools
Detection Notes
Treat an unexpected Event 16 as possible T1562.001 Disable or Modify Tools when the new configuration disables or broadly excludes high-value filters such as ProcessCreate, NetworkConnect, DriverLoad, ImageLoad, PipeEvent, RegistryEvent, or changes HashAlgorithms from SHA256/* to weaker or empty coverage. Microsoft documents Event 16 as a Sysmon configuration-change event and shows configuration updates with sysmon64.exe -c C:\\Windows\\config.xml; it also documents ArchiveDirectory with default C:\\Sysmon, CopyOnDeletePE, DnsLookup, and HashAlgorithms, so compare those concrete fields with the approved baseline. Correlate the UtcTime with process creation for sysmon64.exe -c, service-control activity, and change-ticket evidence before suppressing.
Sysmon
| where EventID == 16
| project TimeGenerated, Computer, Image, ProcessGuidindex=sysmon EventCode=16 | table _time, host, Image, ProcessGuidUtcTime: 2026-07-13 01:00:00.000
Configuration: EventFiltering updated; ProcessCreate onmatch=exclude
HashAlgorithms: SHA256
ArchiveDirectory: Sysmon