Sysmon Event ID 5: Process terminated
- Applicable version
- Sysmon 1.0 and later
- Last reviewed
- 2026-07-21
Quick summary
Sysmon Event ID 5 records that a monitored process exited, logging its UtcTime, ProcessGuid, ProcessId, and Image path at termination.
Technical Metadata
| Event ID | 5 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | No reliable mapping listed |
| Key fields to watch | ProcessGuid, Image, UtcTime |
Trigger Scenarios
Sysmon logs Event ID 5 every time a monitored process ends, whether through normal completion, a user closing it, a crash, or being killed by another process or by security tooling. The event carries almost no context beyond process identity, so its value is in timing correlation rather than standalone content.
Key Fields
ProcessGuid
The unique identifier for this specific process instance. Because ProcessId is reused by the OS over time, ProcessGuid is the only reliable key to join this termination back to the exact Event ID 1 creation record and any Event ID 3, 8, 10, or 11 events generated during that process's lifetime.
Image
The executable path of the process that ended. A short-lived security or logging process (wevtutil.exe, vssadmin.exe, an EDR agent binary) terminating is more significant than a routine utility exiting.
UtcTime
The exact termination timestamp. A termination occurring within seconds of a file-deletion (Event ID 23/26) or event-log-clear (4719/1102) timestamp for the same host supports a deliberate cleanup sequence rather than coincidence.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 5
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=5
| table _time, host, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 5- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
title: Sysmon Event ID 5
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 5
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 5 | A monitored process terminated. | Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source |
| ProcessGuid | GUID | Stable process-lifetime key used to join the termination to Event 1 and related activity. | Use ProcessGuid together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
No reliable mapping listed.
Detection Notes
Sysmon Event 5 has no direct ATT&CK technique mapping because process termination is lifecycle telemetry, not an attack behavior by itself. Investigate when the same ProcessGuid belongs to an image under C:\Users\ or C:\Temp\ and terminates within threshold=60 seconds of Event ID 23/26 file deletion, Event 1102 log clearing, or security-tool disruption; the 60-second threshold is a tunable local correlation window.
Common False Positives
- The overwhelming majority of Event ID 5 records are routine terminations of ordinary user and system processes with no security relevance.
- Software updaters and installers that launch short-lived helper processes generate high volumes of this event during patch cycles.
Related Events
Sample Log
UtcTime: 2026-07-12 10:02:47.812
ProcessGuid: {aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee}
ProcessId: 6188
Image: C:\Windows\System32\cipher.exeFrequently Asked Questions
What does Sysmon Event ID 5 mean?
A monitored process terminated and Sysmon recorded its time and process identifiers.
Does Event ID 5 always indicate malicious activity?
No. It is process-lifecycle telemetry and carries no malicious classification by itself.
How should Event ID 5 be investigated?
Join ProcessGuid to Event 1, calculate runtime, and correlate nearby file deletion, log clearing, or security-tool disruption.
Sources
- 5: Process terminated
Microsoft Sysinternals · vendor
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule