Log Dejargonizer

Sysmon · Event 5

Sysmon Event 5: A process ended

A process exited. On its own it says almost nothing, but paired with the matching Event 1 it gives you how long a process lived — and very short-lived processes are a pattern worth noticing.

Also written as Sysmon 5Sysmon Event ID 5Process terminatedSysmon ProcessTerminate

What it means for you

For an analyst

Its value is timeline reconstruction. Joining Event 1 and Event 5 on ProcessGuid gives process lifetime, which is how you spot the sub-second processes that automated tooling produces and the long-lived ones that beacons produce.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Process terminated:
  RuleName: -
  UtcTime: 2026-08-28 09:14:12.884
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  User: CORP\jbrooks

The fields that decide it

Everything else in the log line is context.

Image
The process that ended.
ProcessGuid
The stable identifier. Join on it to the Event 1 for this process to calculate lifetime.
User
The account it ran under.
UtcTime
When it exited.

Ordinary reasons this happens

Most of the time it is one of these.

  • Every program closing, which is most of the volume.
  • Short-lived utilities that run and exit immediately.
  • Scheduled tasks completing.
  • Build tools and scripts spawning many short-lived children.

What to do next

  1. Join on ProcessGuid to Event 1 to get the creation time and the command line.
  2. Calculate lifetime. Sub-second processes in bursts suggest scripted activity.
  3. During an investigation, use termination times to bound what a process could have been responsible for.
  4. Look for security processes terminating unexpectedly, which is a different question entirely.

Queries to run

kql Very short-lived processes. Automated tooling produces these in bursts; a person does not. 
let starts = Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 1 | project ProcessGuid, Start = TimeGenerated, Image, CommandLine;
let ends = Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 5 | project ProcessGuid, End = TimeGenerated;
starts | join kind=inner ends on ProcessGuid | extend Lifetime = End - Start | where Lifetime < 2s | project Start, Image, CommandLine, Lifetime

Common questions

What is Sysmon Event 5 useful for?

Timeline reconstruction. On its own it just says a process ended, but joined to the matching Event 1 on ProcessGuid it gives you exactly how long the process ran. That bounds what it could have done, and it surfaces the sub-second processes that scripted activity produces in bursts.

Read next

Vendor documentation

Last reviewed 28 August 2026