Log Dejargonizer

Sysmon · Event 5

Sysmon Event 5: A process ended

A process exited. On its own it says almost nothing, but paired with the matching Event 1 it gives you how long a process lived — and very short-lived processes are a pattern worth noticing.

Also written as Sysmon 5Sysmon Event ID 5Process terminatedSysmon ProcessTerminate

What it means for you

For an analyst

Its value is timeline reconstruction. Joining Event 1 and Event 5 on ProcessGuid gives process lifetime, which is how you spot the sub-second processes that automated tooling produces and the long-lived ones that beacons produce.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Process terminated:
  RuleName: -
  UtcTime: 2026-08-28 09:14:12.884
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  User: CORP\jbrooks

The fields that decide it

Everything else in the log line is context.

Image
The process that ended.
ProcessGuid
The stable identifier. Join on it to the Event 1 for this process to calculate lifetime.
User
The account it ran under.
UtcTime
When it exited.

Ordinary reasons this happens

Most of the time it is one of these.

  • Every program closing, which is most of the volume.
  • Short-lived utilities that run and exit immediately.
  • Scheduled tasks completing.
  • Build tools and scripts spawning many short-lived children.

What to do next

  1. Join on ProcessGuid to Event 1 to get the creation time and the command line.
  2. Calculate lifetime. Sub-second processes in bursts suggest scripted activity.
  3. During an investigation, use termination times to bound what a process could have been responsible for.
  4. Look for security processes terminating unexpectedly, which is a different question entirely.

Queries to run

kql Very short-lived processes. Automated tooling produces these in bursts; a person does not. 
let starts = Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 1 | project ProcessGuid, Start = TimeGenerated, Image, CommandLine;
let ends = Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 5 | project ProcessGuid, End = TimeGenerated;
starts | join kind=inner ends on ProcessGuid | extend Lifetime = End - Start | where Lifetime < 2s | project Start, Image, CommandLine, Lifetime

Common questions

What is Sysmon Event 5 useful for?

Timeline reconstruction. On its own it just says a process ended, but joined to the matching Event 1 on ProcessGuid it gives you exactly how long the process ran. That bounds what it could have done, and it surfaces the sub-second processes that scripted activity produces in bursts.

Why does Sysmon Event 5 carry so little information?

Because by the time a process ends, most of what described it is already gone. Sysmon records the process ID, the image path and the time; the command line, parent and hashes were captured in the Event 1 at creation. The design assumes you keep both and join them on the process GUID, which is unique in a way the process ID is not.

How do I match Sysmon Event 5 to the Event 1 that started the process?

Join on ProcessGuid, not ProcessId. Windows reuses process IDs freely, so on a busy machine the same PID can belong to several different processes within an hour and matching on it produces wrong answers. The GUID is unique per process and is precisely what it exists for.

What does an unusually short process lifetime tell me?

That the process did something small and exited, which describes both ordinary tooling and a great deal of malicious activity — a dropper that runs once, a command executed through a script host, a living-off-the-land binary invoked for a single task. Very short lifetimes are worth noticing as a pattern rather than individually, especially when the same short-lived image appears repeatedly across a fleet.

Read next

Vendor documentation

Last reviewed 28 August 2026