System Event ID 6013 — The system uptime is — SecOps Tools

Why event 6013 matters

Systems that should be continuously running showing short uptimes indicate unexpected reboots — possible attack activity or instability.

How to detect it

Monitor for servers with unexpected low uptime values that don't correlate with planned maintenance.

Log source

System

Logged by default in the System channel; no audit policy required.

Fields to pivot on

param1param2Computer

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "System" and EventID == 6013   // The system uptime is
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:System" EventCode=6013
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The system uptime is — add EventData fields: param1, param2, Computer`

Hunt event 6013 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Event Log Service events

6005 The Event Log service was started 6006 The Event Log service was stopped 6008 The previous system shutdown was unexpected 6009 Microsoft Windows version

Frequently asked questions

What is System Event ID 6013?

The system uptime is. Logged daily, records the system uptime in seconds.

Which log records event 6013?

Event 6013 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.

How do you detect activity around event 6013?

Monitor for servers with unexpected low uptime values that don't correlate with planned maintenance.