Sysmon Event ID 4: Sysmon service state changed
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-22
Quick summary
Sysmon Event ID 4 reports that the Sysmon service state changed.
Technical Metadata
| Event ID | 4 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0005 Defense Evasion / T1562.001 Impair Defenses: Disable or Modify Tools |
| Key fields to watch | State, UtcTime, Computer |
Trigger Scenarios
Microsoft documents that this event reports the Sysmon service state as started or stopped.
Key Fields
State
The service state transition. A stopped state means Sysmon telemetry collection may be degraded or absent.
UtcTime
UTC timestamp for aligning the service transition with process creation, service-control, and configuration-change events.
Computer
The host whose Sysmon service state changed; prioritize domain controllers, jump hosts, and security tooling servers.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 4
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=4
| table _time, host, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 4- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
title: Sysmon Event ID 4
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 4
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 4 | Sysmon service state changed; this event cannot be filtered. | Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
| State | Stopped | The Sysmon service reported a stopped transition. | Interpret State with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1562.001Impair Defenses: Disable or Modify Tools
Detection Notes
Use threshold=1 unexpected stopped transition on high-value hosts. Microsoft documents Event 4 as Sysmon service started or stopped telemetry; a stopped state after sysmon64.exe -u, sc.exe stop, or a service-control process under C:\Windows\System32 can indicate T1562.001 Disable or Modify Tools. Correlate UtcTime with Event 1 process creation, Event 16 configuration changes, and Event 255 errors before suppressing planned upgrades.
Common False Positives
- Approved Sysmon upgrades and configuration reloads can restart the service.
- Host shutdown and boot cycles can produce expected started or stopped transitions.
Related Events
Sample Log
UtcTime: 2026-07-13 03:00:00.000
State: Stopped
Image: C:\Windows\System32\sc.exe
Computer: HOST01Frequently Asked Questions
What does Sysmon Event ID 4 mean?
The Sysmon service started or stopped.
Does Event ID 4 always indicate malicious activity?
No. Reboots, upgrades, and approved maintenance produce state changes.
How should Event ID 4 be investigated?
Review State and UtcTime and correlate with process creation, configuration changes, and service errors.
Sources
- 4: Sysmon service state changed
Microsoft Sysinternals · vendor
- Impair Defenses: Disable or Modify Tools (T1562.001)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule