Sysmon Event IDs

Every Sysmon event, grouped by what it catches — with the field that matters and why it fires. The host-telemetry companion to the Windows Event IDs sheet. Click any ID to copy it.

Start here

About Sysmon

Sysmon (System Monitor) is a Sysinternals driver + service that writes rich host telemetry to its own log — Microsoft-Windows-Sysmon/Operational — separate from the Security log. Its IDs are Sysmon's own numbering, unrelated to Security event IDs. What you actually see depends on the config: a bare install logs almost nothing useful, so real detection comes from a tuned config (SwiftOnSecurity, Olaf Hartong's modular config, or the MITRE-mapped sysmon-modular). Get it from the Sysinternals sheet. Read these events with wevtutil / Get-WinEvent, and pair with the Windows Event IDs sheet.

Channel: Microsoft-Windows-Sysmon/OperationalWhere every ID below lands. Not in Security/System — it's its own Applications-and-Services log.
Config is everythingAn ID being silent usually means the config filters it, not that nothing happened. sysmon -c shows (or updates) the running config.
ProcessGuid ties it togetherEvery event carries a ProcessGuid — a unique, reboot-stable ID for a process. Pivot on it to assemble one process's whole story across event types.
Hashes on by default where usefulProcess-create and image-load can log MD5/SHA256/IMPHASH — pivot a hash straight to VirusTotal.

Capability

Process activity

The backbone — who ran what, from where, as whom, and who touched whom.

1 — Process CreateThe big one. Full command line, image path, hashes, ParentImage/ParentCommandLine, user, and CurrentDirectory. The parent-child chain is where you spot winword → powershell. The Sysmon counterpart to Security 4688.
5 — Process TerminatedA process ended. Pairs with ID 1 (via ProcessGuid) to bound a process's lifetime — useful for short-lived droppers.
10 — ProcessAccessA process opened a handle to another. The LSASS-dump signal — GrantedAccess like 0x1010/0x1410 against lsass.exe = credential theft (Mimikatz, comsvcs). CallTrace shows the calling module. High-signal, noisy — needs tuning.
8 — CreateRemoteThreadA thread created in another process — the classic process-injection primitive. StartAddress/StartModule point at the injected code. Legit uses exist, so baseline the noisy sources.
25 — Process TamperingImage mismatch from process hollowing / herpaderping / doppelgänging — the on-disk image doesn't match what's running. Rare and high-fidelity when it fires.

Capability

Network & DNS

3 — Network ConnectionA TCP/UDP connection with the process, source/dest IP & port, and whether it's initiated. The beacon/C2 catcher — a non-browser reaching the internet stands out. Often filtered to specific processes/ports to cut volume.
22 — DNS QueryThe process, the queried name, and the result. Catches DNS-based C2, DGA domains, and odd lookups from a process that shouldn't resolve anything.

Capability

Image & driver loads

7 — Image/DLL LoadedA module loaded into a process, with path, hashes, and signature status. The DLL side-loading detector — an unsigned or out-of-place DLL in a trusted process. Very high volume; config-gated.
6 — Driver LoadedA kernel driver loaded, with hashes and signature. The BYOVD (bring-your-own-vulnerable-driver) signal — an unsigned or known-bad driver loading is high-interest.

Capability

File activity

11 — File CreateA file created or overwritten, with path and the creating process. Catches dropped payloads, staged exfil, ransomware notes. Usually scoped to interesting paths/extensions.
2 — File Creation Time ChangedTimestomping — a process altered a file's creation time to blend in. Legit installers do it occasionally; from an odd process it's anti-forensics.
23 — File Delete (archived)A file was deleted and Sysmon saved a copy to the archive directory — recover a self-deleting dropper. Can fill disk fast; scope it.
26 — File Delete LoggedSame delete event but without archiving the file — the lightweight version when you just need the record.
9 — RawAccessReadRaw volume read with \\.\ device syntax — used to bypass the filesystem to read locked files (e.g. the SAM, NTFS internals). Noisy from backup tools; interesting elsewhere.
15 — FileCreateStreamHashAn alternate data stream was created, with a hash and the Zone.Identifier (Mark-of-the-Web). Catches payloads hidden in ADS and downloaded-file provenance.

Capability

Registry

Maps onto the persistence keys in the Registry sheet.

12 — Registry Key/Value create & deleteKey or value added/removed. Watch Run keys, Services, and the IFEO path — persistence being written.
13 — Registry Value SetA value's data was set — the most useful registry ID. A new Run value, a changed service ImagePath, or a Winlogon tweak shows here with the data written.
14 — Registry Key/Value RenameRename of a key or value — a quieter way to alter config without a clean create/delete pair.

Capability

Pipes, WMI, DNS & clipboard

17 — Pipe Created  ·  18 — Pipe ConnectedNamed-pipe create/connect. C2 frameworks (Cobalt Strike's default pipe names), PsExec's PSEXESVC pipe, and lateral-movement toolkits show distinctive pipe names here.
19 — WMI EventFilterA WMI event filter registered — the trigger half of WMI persistence. Rare legitimately; a strong flag.
20 — WMI EventConsumerA WMI consumer registered — the action half (often a command/script to run). The payload of WMI persistence.
21 — WMI ConsumerToFilter bindingA consumer bound to a filter — the two halves wired together. 19+20+21 together = active WMI persistence.
24 — Clipboard ChangeClipboard contents captured (text). Catches clipboard-stealers and some RDP data movement. Privacy-sensitive — many configs leave it off.

Operational

Service state, config & the rest

Sysmon's own housekeeping events — and the two that tell you Sysmon itself was touched.

4 — Sysmon Service State ChangedSysmon started or stopped. A stop you didn't schedule = someone blinding the sensor. Alert on it.
16 — Sysmon Config ChangedThe Sysmon config was updated. An unexpected config change can quietly disable the very rules you rely on — tampering. Watch closely.
255 — Sysmon ErrorSysmon itself hit an error. A burst can indicate problems — or an attacker stressing/evading the sensor.
27 — File Block Executable  ·  28 — File Block ShreddingNewer blocking events (Sysmon 14+): 27 blocked a banned executable from being written; 28 blocked a secure-delete/shred attempt. Prevention, not just detection.
29 — File Executable DetectedAn executable file was created (detection companion to the block rules) — flags new PEs landing on disk.

The high-signal short list: 10 (LSASS access), 8 (remote thread / injection), 25 (process tampering), 6 (driver / BYOVD), 13 (registry persistence), 19-21 (WMI persistence), and 4/16 (Sysmon stopped or reconfigured). If you tune nothing else, tune and alert on these.