Sysmon Event ID 5: Process terminated
Sysmon Event ID 5 records that a monitored process exited, logging its UtcTime, ProcessGuid, ProcessId, and Image path at termination.
- Applicable version
- Sysmon 1.0 and later
- Last reviewed
- 2026-07-12
Trigger Scenarios
Sysmon logs Event ID 5 every time a monitored process ends, whether through normal completion, a user closing it, a crash, or being killed by another process or by security tooling. The event carries almost no context beyond process identity, so its value is in timing correlation rather than standalone content.
Key Fields
ProcessGuid
The unique identifier for this specific process instance. Because ProcessId is reused by the OS over time, ProcessGuid is the only reliable key to join this termination back to the exact Event ID 1 creation record and any Event ID 3, 8, 10, or 11 events generated during that process's lifetime.
Image
The executable path of the process that ended. A short-lived security or logging process (wevtutil.exe, vssadmin.exe, an EDR agent binary) terminating is more significant than a routine utility exiting.
UtcTime
The exact termination timestamp. A termination occurring within seconds of a file-deletion (Event ID 23/26) or event-log-clear (4719/1102) timestamp for the same host supports a deliberate cleanup sequence rather than coincidence.
Common False Positives
- The overwhelming majority of Event ID 5 records are routine terminations of ordinary user and system processes with no security relevance.
- Software updaters and installers that launch short-lived helper processes generate high volumes of this event during patch cycles.
Related Events
MITRE ATT&CK Mapping
- T1070.004Indicator Removal: File Deletion
Detection Notes
T1070.004 cleanup gains meaning when the same ProcessGuid was created under C:\\Users\\ or C:\\Temp\\ and terminates within 60 seconds of Event ID 23/26 deletion or log-clearing activity. Event 5 alone records only UtcTime, ProcessGuid, and ProcessId.
Sysmon
| where EventID == 5
| join kind=inner (Sysmon | where EventID in (23, 26)) on ProcessGuid
| where abs(datetime_diff('second', TimeGenerated, TimeGenerated1)) < 10
| project TimeGenerated, Computer, Image, ProcessGuid, TargetFilenameindex=sysmon EventCode=5
| join ProcessGuid [search index=sysmon EventCode IN (23,26)]
| eval gap=abs(_time-_time1)
| where gap<10
| table _time, host, Image, ProcessGuid, TargetFilename, gapUtcTime: 2026-07-12 10:02:47.812
ProcessGuid: {aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee}
ProcessId: 6188
Image: C:\Windows\System32\cipher.exe