Event ID 4
Sysmon service state changed (Sysmon started or stopped)Source:
Microsoft-Windows-Sysmon
Category:
Sysmon service state changed
Sysmon service state changed: UtcTime: %1!s! State: %2!s! Version: %3!s! SchemaVersion: %4!s!
The service state change event reports the state of the Sysmon service (started or stopped).
Auditing:
Always
This event is logged when Sysmon is started or stopped and includes the version of Sysmon as well as the configuration. This event is always logged.
Volume:
Low
LEFT/RIGHT arrow keys for navigation
Back to List