Event ID 6006InformationSystem
Windows Event ID 6006 — Event Log Service Stopped
Logged when the Windows Event Log service stops — marks a clean, controlled shutdown.
Why It Matters
A 6006 without a subsequent 6005 in the expected window, or 6006 followed by 6005 at an unexpected time, can mark attacker-initiated reboots.
Investigation Tips
- 1.Planned maintenance shutdowns should have a 6006 followed by 6005 within the expected maintenance window.
- 2.Unplanned 6006 + 6005 pairs outside maintenance hours warrant investigation.
Go deeper: the full Windows Defender Disabled or Tampered guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Windows Defender Disabled or Tampered guide →See Event ID 6006 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →