SOC Event Lookup
Event ID 16ConfigP2

Sysmon Event ID 16: ServiceConfigurationChange (Sysmon config change)

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-21

Quick summary

Sysmon Event ID 16 records changes to the active Sysmon configuration.

Technical Metadata

Technical metadata for Event ID 16
Event ID16
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0005 Defense Evasion / T1562.001 Disable or Modify Tools
Key fields to watchConfiguration state, EventFiltering, UtcTime

Trigger Scenarios

Sysmon emits this event when the service configuration changes, including when filtering rules are updated. Microsoft documents Sysmon configuration entries such as ArchiveDirectory, HashAlgorithms, DnsLookup, CopyOnDeletePE, and event-filtering include/exclude rules.

Key Fields

Configuration state

Review the recorded configuration change against the approved Sysmon XML baseline. Changes to HashAlgorithms, ArchiveDirectory, CopyOnDeletePE, or event filters can materially change telemetry coverage.

EventFiltering

Microsoft documents include/exclude filter tags such as ProcessCreate, NetworkConnect, DriverLoad, ImageLoad, PipeEvent, and RegistryEvent. Removing coverage or adding broad exclusions can blind detection.

UtcTime

Use the configuration-change time to correlate with service-control events, file changes, and process creation from administrators or deployment tools.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 16
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 16
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 16
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=16
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 16
dataset = microsoft_windows_raw
| filter edr_event_id = 16
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 16
title: Sysmon Event ID 16
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 16
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID16The active Sysmon configuration changed; this event cannot be filtered out.Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source
HashAlgorithms*The documented wildcard enables all supported hashing algorithms.Use HashAlgorithms together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1562.001Disable or Modify Tools

Detection Notes

T1562.001 Disable or Modify Tools is supported when Event 16 coincides with sysmon64.exe -c C:\Windows\config.xml and the approved XML diff removes ProcessCreate, NetworkConnect, DriverLoad, ImageLoad, PipeEvent, or RegistryEvent coverage, or changes HashAlgorithms from SHA256 or * to weaker coverage. Event 16 establishes that configuration changed but does not by itself prove which filter changed; compare the deployed file with the controlled baseline and validate UtcTime against process creation and the change ticket.

Common False Positives

  • Approved administration, management agents, and deployment tools can generate this telemetry.
  • Baseline expected hosts, signed binaries, and change windows before suppression.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 01:00:00.000
Configuration: EventFiltering updated; ProcessCreate onmatch=exclude
HashAlgorithms: SHA256
ArchiveDirectory: Sysmon

Frequently Asked Questions

What does Sysmon Event ID 16 mean?

The active Sysmon configuration changed, such as an update to event filtering.

Does Event ID 16 always indicate malicious activity?

No. Approved configuration deployment and tuning generate it legitimately.

How should Event ID 16 be investigated?

Compare the new configuration with the approved XML baseline and correlate the time with sysmon64.exe process and change records.

Sources

Machine-readable JSON