SOC Event Lookup
Event ID 4609SystemP3

Windows Event ID 4609: Windows is shutting down

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4609 is the defined Windows shutdown audit event, but Microsoft states that current Windows versions do not invoke it.

Technical Metadata

Technical metadata for Event ID 4609
Event ID4609
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKNo reliable mapping listed
Key fields to watchEventID / TimeCreated, Computer, Pairing with 4608

Trigger Scenarios

The event is defined for operating-system shutdown; however, Microsoft documents that it is not currently generated by Windows.

Key Fields

EventID / TimeCreated

Shutdown timestamp for the audited system.

Computer

The host that is shutting down.

Pairing with 4608

A following 4608 indicates restart; absence can indicate extended downtime.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4609
SecurityEvent
| where EventID == 4609
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4609
index=wineventlog source="WinEventLog:Security" EventCode=4609
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4609
dataset = microsoft_windows_raw
| filter edr_event_id = 4609
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4609
title: Windows Security Event ID 4609
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4609
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID4609A defined Windows shutdown audit event that Microsoft states is not currently invoked.Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source
Generationnot invokedMicrosoft documents that current Windows versions do not generate this defined event.Interpret Generation with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

No reliable mapping listed.

Detection Notes

Event 4609 has no direct ATT&CK technique mapping and no reliable standalone detection role because Microsoft states it is defined but not invoked by current Windows versions. Do not infer T1529 merely because 4609 is absent. If a 4609 record is observed, validate provider and XML; investigate shutdown or reboot through System-channel kernel events, uptime and hypervisor telemetry using a local correlation window=15 minutes.

Common False Positives

  • Planned patching, maintenance, and operator-initiated reboots.
  • Power events and virtualization host operations can shut down guest systems normally.

Related Events

Sample Log

Sanitized event sample
EventID: 4609
Computer: DC01
TimeCreated: 2026-07-13T03:09:00Z

Frequently Asked Questions

What does Windows Event ID 4609 mean?

It is the defined Windows shutdown audit event, but Microsoft states the operating system does not currently invoke it.

Does Event ID 4609 always indicate malicious activity?

Its absence is expected and must not be treated as evidence of an improper shutdown.

How should Event ID 4609 be investigated?

Use System log, kernel, uptime, hypervisor, and power-management telemetry to investigate shutdowns instead of depending on 4609.

Sources

Machine-readable JSON