# Event ID 5: Process terminated
###### Version: 4.81

## Description
The **process terminate** event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.

## Data Dictionary
|Field Name|Type|Description|Sample Value|
|---|---|---|---|
|RuleName|string|custom tag mapped to event. i.e ATT&CK technique ID|`T1114`|
|UtcTime|date|Time in UTC when event was created|`2021-10-13T20:06:22.6470000Z`|
|ProcessGuid|string|Process Guid of the process that terminated|`{A98268C1-9ECD-5ACD-0000-0010EF6BAF00}`|
|ProcessId|integer|Process ID used by the os to identify the process that terminated|`2428`|
|Image|string|File path of the process that terminated|`rsyslogd`|
|User|string|Name of the account that terminated the process.|`syslog`|