Event ID 4688: A new process has been created
Written every time a process starts, with its parent process and, if enabled, its full command line.
- Log
- Security
- Category
- Process
Why it matters
- The single most useful event for spotting attacker activity, but only once command-line logging is turned on.
- Look for Office apps starting shells, encoded PowerShell, LOLBins (certutil, mshta, rundll32, regsvr32) and processes running from temp folders.
What to check
Check New Process Name, Process Command Line, Creator Process Name, the account and Token Elevation Type.
How to turn it on
Advanced Audit Policy: Detailed Tracking > Audit Process Creation, plus Group Policy 'Include command line in process creation events'.
MITRE ATT&CK
- T1059.003 Windows Command Shell
- T1059.001 PowerShell