Sysmon Event ID 16 — Sysmon configuration state changed — SecOps Tools

Why event 16 matters

Attackers who gain admin access may modify Sysmon configuration to exclude their tools from monitoring. Configuration changes that reduce coverage are defense evasion.

How to detect it

Alert: configuration change during non-maintenance windows. Compare ConfigurationFileHash against known-good baseline.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Defense Evasion	Disable or Modify Tools (T1562.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 16   // Sysmon configuration state changed
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=16
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Sysmon configuration state changed — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 16 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 16?

Sysmon configuration state changed. Sysmon configuration was updated. ConfigurationFileHash indicates what changed.

Which log records event 16?

Event 16 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 16?

Event 16 is associated with: Disable or Modify Tools (T1562.001).

How do you detect activity around event 16?

Alert: configuration change during non-maintenance windows. Compare ConfigurationFileHash against known-good baseline.