Event ID 5
Process terminatedSource:
Microsoft-Windows-Sysmon
Category:
Process terminated (rule: ProcessTerminate)
Process terminated: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! User: %6!s!
The process terminate event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.
Auditing:
Conditional
Similar to event id 1, this event corresponds to event id 4689 of Windows. If event 1 (ProcessCreate) is already enabled, then this event ("ProcessTerminate") should be enabled as well.
Volume:
Medium
High
LEFT/RIGHT arrow keys for navigation
Back to List