Sysmon Event ID 4

Discussions on Event ID 4
Ask a question about this event

4: Sysmon service state changed

This is an event from Sysmon.

On this page

The service state change event reports the state of the Sysmon service (started or stopped).

Free Security Log Resources by Randy

Description Fields in 4

  •  Log Name
  • Source
  • Date
  • Event ID
  • Task Category
  • Level
  • Keywords
  • User
  • Computer
  • Description
  • UtcTime
  • State
  • Version
  • SchemaVersion

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.



Examples of 4

Sysmon service state changed:
UtcTime: 2017-04-28 22:52:20.883
State: Stopped
Version: 6.01
SchemaVersion: 3.30


Event XML:
 <Event xmlns="">
        <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
        <TimeCreated SystemTime="2017-04-28T22:52:20.883759300Z" />
        <Correlation />
        <Execution ProcessID="3216" ThreadID="3220" />
        <Security UserID="S-1-5-18" />
        <Data Name="UtcTime">2017-04-28 22:52:20.883</Data>
        <Data Name="State">Stopped</Data>
        <Data Name="Version">6.01</Data>
        <Data Name="SchemaVersion">3.30</Data>

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources