{
  "id": "16",
  "source": "sysmon",
  "category": "Config",
  "name": "ServiceConfigurationChange (Sysmon config change)",
  "priority": "P2",
  "applicable_version": "Sysmon with this event enabled",
  "last_reviewed": "2026-07-13",
  "definition": "Sysmon Event ID 16 records changes to the active Sysmon configuration.",
  "trigger_scenarios": "Sysmon emits this event when the service configuration changes, including when filtering rules are updated. Microsoft documents Sysmon configuration entries such as ArchiveDirectory, HashAlgorithms, DnsLookup, CopyOnDeletePE, and event-filtering include/exclude rules.",
  "key_fields": [
    {
      "field": "Configuration state",
      "explanation": "Review the recorded configuration change against the approved Sysmon XML baseline. Changes to HashAlgorithms, ArchiveDirectory, CopyOnDeletePE, or event filters can materially change telemetry coverage."
    },
    {
      "field": "EventFiltering",
      "explanation": "Microsoft documents include/exclude filter tags such as ProcessCreate, NetworkConnect, DriverLoad, ImageLoad, PipeEvent, and RegistryEvent. Removing coverage or adding broad exclusions can blind detection."
    },
    {
      "field": "UtcTime",
      "explanation": "Use the configuration-change time to correlate with service-control events, file changes, and process creation from administrators or deployment tools."
    }
  ],
  "false_positives": [
    "Approved administration, management agents, and deployment tools can generate this telemetry.",
    "Baseline expected hosts, signed binaries, and change windows before suppression."
  ],
  "related_event_ids": [
    "1"
  ],
  "attck_mapping": [
    {
      "technique_id": "T1562.001",
      "technique_name": "Impair Defenses: Disable or Modify Tools"
    }
  ],
  "detection_notes": "Treat an unexpected Event 16 as possible T1562.001 Disable or Modify Tools when the new configuration disables or broadly excludes high-value filters such as ProcessCreate, NetworkConnect, DriverLoad, ImageLoad, PipeEvent, RegistryEvent, or changes HashAlgorithms from SHA256/* to weaker or empty coverage. Microsoft documents Event 16 as a Sysmon configuration-change event and shows configuration updates with sysmon64.exe -c C:\\\\Windows\\\\config.xml; it also documents ArchiveDirectory with default C:\\\\Sysmon, CopyOnDeletePE, DnsLookup, and HashAlgorithms, so compare those concrete fields with the approved baseline. Correlate the UtcTime with process creation for sysmon64.exe -c, service-control activity, and change-ticket evidence before suppressing.",
  "kql_snippet": "Sysmon\n| where EventID == 16\n| project TimeGenerated, Computer, Image, ProcessGuid",
  "spl_snippet": "index=sysmon EventCode=16 | table _time, host, Image, ProcessGuid",
  "sample_log": "UtcTime: 2026-07-13 01:00:00.000\nConfiguration: EventFiltering updated; ProcessCreate onmatch=exclude\nHashAlgorithms: SHA256\nArchiveDirectory: Sysmon",
  "source_url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
  "route": "/sysmon-events/16/",
  "canonical_url": "https://soceventlookup.com/sysmon-events/16/",
  "json_url": "/api/events/sysmon/16.json"
}