A process has terminated. Complements Event 1 for process lifetime analysis.
Short-lived processes (created and terminated within seconds) indicate payload execution. Compare Sysmon 1 (create) + Sysmon 5 (terminate) timestamps.
No standalone alerting. Calculate process lifetimes for forensic timelines.
ImageCommandLineParentImageUserHashes Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 5 // Process terminated
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=5
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Process terminated — add EventData fields: Image, CommandLine, ParentImage, User`Process terminated. A process has terminated. Complements Event 1 for process lifetime analysis.
Event 5 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
No standalone alerting. Calculate process lifetimes for forensic timelines.