SOC Event Lookup
Event ID 4ServiceP3

Sysmon Event ID 4: Sysmon service state changed

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 4 reports that the Sysmon service state changed.

Technical Metadata

Technical metadata for Event ID 4
Event ID4
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0005 Defense Evasion / T1562.001 Impair Defenses: Disable or Modify Tools
Key fields to watchState, UtcTime, Computer

Trigger Scenarios

Microsoft documents that this event reports the Sysmon service state as started or stopped.

Key Fields

State

The service state transition. A stopped state means Sysmon telemetry collection may be degraded or absent.

UtcTime

UTC timestamp for aligning the service transition with process creation, service-control, and configuration-change events.

Computer

The host whose Sysmon service state changed; prioritize domain controllers, jump hosts, and security tooling servers.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 4
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 4
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 4
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=4
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 4
dataset = microsoft_windows_raw
| filter edr_event_id = 4
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 4
title: Sysmon Event ID 4
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 4
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID4Sysmon service state changed; this event cannot be filtered.Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source
StateStoppedThe Sysmon service reported a stopped transition.Interpret State with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1562.001Impair Defenses: Disable or Modify Tools

Detection Notes

Use threshold=1 unexpected stopped transition on high-value hosts. Microsoft documents Event 4 as Sysmon service started or stopped telemetry; a stopped state after sysmon64.exe -u, sc.exe stop, or a service-control process under C:\Windows\System32 can indicate T1562.001 Disable or Modify Tools. Correlate UtcTime with Event 1 process creation, Event 16 configuration changes, and Event 255 errors before suppressing planned upgrades.

Common False Positives

  • Approved Sysmon upgrades and configuration reloads can restart the service.
  • Host shutdown and boot cycles can produce expected started or stopped transitions.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 03:00:00.000
State: Stopped
Image: C:\Windows\System32\sc.exe
Computer: HOST01

Frequently Asked Questions

What does Sysmon Event ID 4 mean?

The Sysmon service started or stopped.

Does Event ID 4 always indicate malicious activity?

No. Reboots, upgrades, and approved maintenance produce state changes.

How should Event ID 4 be investigated?

Review State and UtcTime and correlate with process creation, configuration changes, and service errors.

Sources

Machine-readable JSON