Event ID 4688: new process created
What Event ID 4688 (new process created) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4688 logs every new process, and with command-line auditing turned on it is the closest thing to an EDR that Windows gives you for free. Without the command line it tells you very little, so check that setting before relying on it.
The fields that matter
| Field | What it tells you |
|---|---|
| New Process Name | Full path of the program that started. |
| Process Command Line | The arguments. Empty unless "Include command line in process creation events" is enabled by policy. |
| Creator Process Name | The parent program (Windows 10 / Server 2016 and later). |
| Token Elevation Type | %%1936 full token, %%1937 elevated, %%1938 limited. |
| Subject | The account that started it. |
What is normal
Installers, management agents, browsers and Office starting their helper processes, and admin scripts on servers.
When Event ID 4688 is suspicious
- Office applications or a browser starting
cmd.exe,powershell.exe,wscript.exeormshta.exe. - PowerShell with
-enc,-EncodedCommand,-w hiddenorIEX. - Built-in tools used to download or run code:
certutil -urlcache,bitsadmin /transfer,regsvr32 /i:http,rundll32with a URL. - Programs running from
AppData,Temp,ProgramDataor a user's Downloads folder. - Bursts of
whoami,net group,nltestoripconfig /all: discovery after a compromise.
Common false positive: Software deployment tools (SCCM, Intune) and RMM agents run long command lines all day. Learn their parent processes and filter by those.
Find Event ID 4688 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4688
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Sysmon Event ID 1: process creation
- PowerShell Event ID 4104: PowerShell script block logged
- System Event ID 7045: New service installed
- Event ID 4698: Scheduled task created
FAQ
How do I turn on command lines in 4688?
Enable "Audit Process Creation" (Advanced Audit Policy > Detailed Tracking) and the policy "Include command line in process creation events" under Administrative Templates > System > Audit Process Creation.
Should I use 4688 or Sysmon Event ID 1?
Sysmon 1 adds file hashes, the parent command line and the original file name, which catches renamed tools. If you can deploy Sysmon, use both; 4688 is the fallback that every Windows machine has.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.