Sysmon Event ID 4: Sysmon service state changed
Sysmon Event ID 4 reports that the Sysmon service state changed.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that this event reports the Sysmon service state as started or stopped.
Key Fields
State
The service state transition. A stopped state means Sysmon telemetry collection may be degraded or absent.
UtcTime
UTC timestamp for aligning the service transition with process creation, service-control, and configuration-change events.
Computer
The host whose Sysmon service state changed; prioritize domain controllers, jump hosts, and security tooling servers.
Common False Positives
- Approved Sysmon upgrades and configuration reloads can restart the service.
- Host shutdown and boot cycles can produce expected started or stopped transitions.
Related Events
MITRE ATT&CK Mapping
- T1562.001Impair Defenses: Disable or Modify Tools
Detection Notes
Use threshold=1 unexpected stopped transition on high-value hosts. Microsoft documents Event 4 as Sysmon service started or stopped telemetry; a stopped state after sysmon64.exe -u, sc.exe stop, or a service-control process under C:\Windows\System32 can indicate T1562.001 Disable or Modify Tools. Correlate UtcTime with Event 1 process creation, Event 16 configuration changes, and Event 255 errors before suppressing planned upgrades.
Sysmon
| where EventID == 4
| project TimeGenerated, Computer, EventID, RenderedDescriptionindex=sysmon EventCode=4 | table _time, host, MessageUtcTime: 2026-07-13 03:00:00.000
State: Stopped
Image: C:\Windows\System32\sc.exe
Computer: HOST01