Sysmon Event ID 1: Process creation
Sysmon's record of a process starting, with command line, parent, hashes and user.
- Log
- Microsoft-Windows-Sysmon/Operational
- Category
- Process
Why it matters
- Richer than 4688: includes file hashes, the parent's command line and a ProcessGuid that links all Sysmon events for the process.
- Most Sysmon-based detection starts here.
What to check
Check Image, CommandLine, ParentImage, ParentCommandLine, User, Hashes and IntegrityLevel.
How to turn it on
Install Sysmon with a configuration that includes ProcessCreate.
MITRE ATT&CK
- T1059.003 Windows Command Shell
- T1059.001 PowerShell