OpsVantage Tools
Tools Guides Event IDs opsvantage.net
Tools / Event IDs / Sysmon Event ID 1

Sysmon Event ID 1: process creation

What Sysmon Event ID 1 (process creation) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.

Log: Microsoft-Windows-Sysmon/Operational · Severity: Informational · MITRE ATT&CK T1059 · Updated 2026-11-03

Sysmon Event ID 1 is process creation, like Windows 4688 but with much more detail: file hashes, the parent's command line and the original file name compiled into the program. That original name catches attackers who rename tools to look harmless.

The fields that matter

FieldWhat it tells you
Image / CommandLineThe program and its arguments.
ParentImage / ParentCommandLineWhat started it, with its own arguments.
HashesMD5, SHA1, SHA256 or IMPHASH, depending on your Sysmon config. You can check them against threat intelligence.
OriginalFileNameThe name inside the file. svchost.exe whose original name is psexec.c was renamed.
User / IntegrityLevelWho ran it, and whether it was elevated.
CurrentDirectoryWhere it ran from.

What is normal

The same programs your machines run every day. Building a baseline of common parent and child pairs makes the odd ones stand out.

When Sysmon Event ID 1 is suspicious

Common false positive: Installers unpack and run files from Temp all the time. Signed installers from known publishers are rarely the problem.

Find Sysmon Event ID 1 with PowerShell

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
  ForEach-Object {
    $d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } | Format-List

Microsoft Sentinel (KQL)

Event
| where TimeGenerated > ago(7d) and Source == "Microsoft-Windows-Sysmon" and EventID == 1
| project TimeGenerated, Computer, RenderedDescription, EventData
| order by TimeGenerated desc

Related events

FAQ

Which Sysmon configuration should I start with?

A well-known community baseline such as SwiftOnSecurity's sysmon-config or Olaf Hartong's sysmon-modular, then tune it for your noise.

How do I check the hashes quickly?

Look them up in VirusTotal or MalwareBazaar. IOC Triage checks a hash against both with a right-click.