Event ID 6005InformationSystem

Windows Event ID 6005 — Event Log Service Started

Logged when the Windows Event Log service starts — effectively marks system startup.

Why It Matters

Acts as a startup marker. Unexpected 6005 events (especially mid-day without a preceding shutdown event) can indicate the system was rebooted by an attacker to apply changes or clear log state.

Investigation Tips

  1. 1.Look for 6005 without a preceding clean 6006 (controlled shutdown) — indicates an unexpected restart.
  2. 2.Correlate the startup time with user activity — a 3am restart on a server is worth investigating.

See Event ID 6005 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →