4 Sysmon log · Sysmon Service State Changed high severity low volume

Sysmon Event ID 4 — Sysmon service state changed

Sysmon service started or stopped.

Why event 4 matters

Sysmon being stopped is a defense evasion technique — attackers disable Sysmon to blind EDR and SIEM. Any unexpected stop of Sysmon warrants immediate investigation.

How to detect it

Alert: State=Stopped during non-maintenance windows. Alert: service state change by non-SYSTEM accounts. Correlate with 7036 (System log) for service state changes.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Disable or Modify Tools (T1562.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Sysmon Service Stopped
status: stable
description: Sysmon service stopped — defense evasion
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 4
        State: 'Stopped'
    condition: selection
falsepositives:
    - Planned maintenance
level: critical
tags:
    - attack.defense_evasion
    - attack.t1562.001
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 4   // Sysmon service state changed
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=4
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Sysmon service state changed — add EventData fields: Image, CommandLine, ParentImage, User`
Hunt event 4 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 4?

Sysmon service state changed. Sysmon service started or stopped.

Which log records event 4?

Event 4 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 4?

Event 4 is associated with: Disable or Modify Tools (T1562.001).

How do you detect activity around event 4?

Alert: State=Stopped during non-maintenance windows. Alert: service state change by non-SYSTEM accounts. Correlate with 7036 (System log) for service state changes.