Event ID 4688: Process Creation and Command Line Logging

Windows Event ID 4688 means "A new process has been created": Windows logs it in the Security log every time a program starts, as long as the Audit Process Creation policy is on. It records the new process, the process that started it, the account and the token type, and, if you enable one extra setting, the full command line.

Out of the box the command line field is empty, so you learn that powershell.exe ran but not what it ran. This post shows how to fix that, which fields to read, and how 4688 compares with Sysmon Event ID 1. For the wider list, see our Windows Event Log IDs cheat sheet.

How do you enable Event ID 4688 with command line logging?

You need two policies.

1. Turn on the audit subcategory. In a Group Policy Object, go to:

Computer Configuration > Policies > Windows Settings > Security Settings >
  Advanced Audit Policy Configuration > Detailed Tracking > Audit Process Creation

Set it to Success. The subcategory has no failure events, so there is nothing to gain from Failure. Microsoft rates the volume as medium to high, depending on how busy the machine is.

2. Add the command line. In the same GPO, go to:

Computer Configuration > Administrative Templates > System > Audit Process Creation >
  Include command line in process creation events

Set it to Enabled. Microsoft notes it only applies when Audit Process Creation is on, and that by default the Process Command Line field is empty.

Three things to know before you roll it out:

• Command lines can contain secrets. Microsoft warns that anyone who can read the Security log can then read every command line, and arguments can include passwords or user data. Restrict who reads the log and treat your SIEM index the same way.
• Advanced and basic audit policy can fight. If basic audit policy settings overwrite your advanced ones, event 4719 is logged. Microsoft's fix is to enable Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings under Security Options.
• Old systems cannot log the command line. The field arrived in event version 1, which Microsoft lists as Windows 8.1 and Windows Server 2012 R2.

Which 4688 fields matter?

Note the naming trap: in the XML, ProcessId is the parent's PID, not the new process. The new one is NewProcessId. Both are hex, so convert before you compare them with Task Manager.

Which Windows versions add the Creator Process Name and parent fields?

Microsoft documents three versions of the event:

So on anything older than Windows 10 you only get the parent's PID, and you have to find the earlier 4688 where that PID was the NewProcessId to learn its name. On Windows 10 and later the parent's full path is in the event.

Even with version 2 there is no parent command line. If you need to know how the parent was launched, you walk back to the parent's own 4688.

What does Token Elevation Type mean?

This field tells you what kind of token User Account Control gave the new process. Windows writes it as a code:

Microsoft suggests two checks. A %%1936 for a real admin account (one whose name does not end in $) usually means UAC is disabled for it. Standard users are different: their token has no linked admin token, which Windows also reports as type 1, so expect %%1936 for them. A %%1937 for a real user on a standard workstation means someone ran a program as administrator. On a fleet where users are not admins, that second one is worth a rule.

The Mandatory Label backs this up. S-1-16-8192 is medium integrity, S-1-16-12288 is high, S-1-16-16384 is system. A shell at high integrity whose parent normally runs at medium is a classic sign of a UAC bypass (T1548.002), though you will need more than one event to prove it.

What does normal 4688 activity look like?

On a typical workstation most 4688s are boring: explorer.exe starting the apps a user clicks, svchost.exe starting system helpers, updaters starting installers, and your management agent running scripts. Learn the top parent and child pairs on your own machines, because "unusual" only means something once you know usual.

What does attacker activity look like in 4688?

Office spawning a shell

A user opens a document, enables macros, and Word starts a shell. This is user execution of a malicious file (T1204.002) followed by an interpreter such as PowerShell (T1059.001).

NewProcessName:    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ParentProcessName: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
CommandLine:       powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0A...
TokenElevationType: %%1938
SubjectUserName:   jsmith

Built-in tools pulling files

certutil.exe with -urlcache -split -f and an external URL is a well-known way to download a payload with a signed Windows binary. MITRE lists certutil under Ingress Tool Transfer (T1105).

Credential dumping with built-ins

MITRE's LSASS Memory page (T1003.001) gives rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full and procdump -ma lsass.exe as examples. Both show up in 4688 with the command line on. Without it you only see rundll32.exe ran, which happens all day.

How do you search for 4688 in Splunk and KQL?

The Splunk searches assume the Splunk Add-on for Microsoft Windows with classic rendering, which extracts fields such as EventCode, New_Process_Name, Creator_Process_Name and Process_Command_Line. With XML rendering you get the XML names (NewProcessName, ParentProcessName, CommandLine) instead.

Office spawning a shell (Splunk)

source="WinEventLog:Security" EventCode=4688
(Creator_Process_Name="*\\WINWORD.EXE" OR Creator_Process_Name="*\\EXCEL.EXE" OR Creator_Process_Name="*\\POWERPNT.EXE")
(New_Process_Name="*\\cmd.exe" OR New_Process_Name="*\\powershell.exe" OR New_Process_Name="*\\wscript.exe" OR New_Process_Name="*\\mshta.exe")
| table _time host Account_Name Creator_Process_Name New_Process_Name Process_Command_Line

Encoded PowerShell (Splunk)

source="WinEventLog:Security" EventCode=4688 New_Process_Name="*\\powershell.exe"
(Process_Command_Line="* -enc *" OR Process_Command_Line="* -e *" OR Process_Command_Line="*-EncodedCommand*")
| table _time host Account_Name Creator_Process_Name Process_Command_Line

Office spawning a shell (KQL, Sentinel)

SecurityEvent
| where EventID == 4688
| where ParentProcessName has_any ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine

LOLBin downloads and LSASS dumps (KQL)

SecurityEvent
| where EventID == 4688
| where (NewProcessName endswith "\\certutil.exe" and CommandLine has "urlcache")
     or (NewProcessName endswith "\\rundll32.exe" and CommandLine has "comsvcs" and CommandLine has "MiniDump")
| project TimeGenerated, Computer, Account, ParentProcessName, CommandLine

If CommandLine is empty in your results, the GPO setting is not applied on those hosts. That is a finding in itself.

What are the common false positives?

• IT scripts and management agents. Deployment tools often run PowerShell, sometimes encoded, to avoid quoting problems. Check the parent and whether the same command runs on many hosts on a schedule.
• Macro-heavy spreadsheets. A macro calling a script on an internal file server is a different story from one fetching a URL.
• Installers and updaters. They start msiexec.exe, rundll32.exe and cmd.exe from temp folders constantly.
• Admins elevating. %%1937 from a known admin running a known tool is expected.

The questions are the same every time: is the parent expected, is the account expected, is the command doing what this program normally does, and has this host done it before?

Event ID 4688 vs Sysmon Event ID 1: which should you use?

Both record process creation. They differ in what they include and what they cost to run.

If you can deploy Sysmon, Event ID 1 is richer: hashes, parent command line and the ProcessGuid make pivots much easier. See Sysmon Event ID 1 for the full field list. But 4688 needs nothing installed, and its token elevation type is a signal Sysmon does not record in the same form. Collecting both is common.

What are the related event IDs?

• 4689, A process has exited. Logged by the Audit Process Termination subcategory. Use it to see how long a process lived.
• 4624, successful logon. The SubjectLogonId on a 4688 matches the TargetLogonId on the 4624 that created the session, so you can list every process an RDP session ran. See Event ID 4624 and logon types.
• 4104, PowerShell script block logging. 4688 shows the PowerShell command line; 4104 shows the script it ran.

FAQ

What is Event ID 4688?

The Windows Security log event "A new process has been created". It is generated by the Audit Process Creation subcategory every time a process starts, and records the new process, its parent, the account and the token type.

Why is the command line empty in Event ID 4688?

Because "Include command line in process creation events" is not enabled. It lives under Computer Configuration, Administrative Templates, System, Audit Process Creation, and it is off by default. It needs Windows 8.1 or Windows Server 2012 R2 or later.

What is the difference between 4688 and Sysmon Event ID 1?

4688 is built in and logs every process, with the command line only if you enable it. Sysmon Event ID 1 needs Sysmon installed, but always includes the command line and adds hashes, the parent command line, OriginalFileName and a ProcessGuid.

What do %%1936, %%1937 and %%1938 mean?

They are Token Elevation Type values. %%1936 is a full token (UAC off, or a built-in or service account), %%1937 is an elevated token (Run as administrator), and %%1938 is a limited token (the normal, unelevated case).

Does Event ID 4688 show the parent process?

Every version has the parent's PID. Creator Process Name, the parent's full path, arrived in event version 2 (Windows 10). No version has the parent's command line.

TL;DR

Event ID 4688 logs every new process in the Security log. Turn on Audit Process Creation for Success, then enable "Include command line in process creation events", or the command line stays empty. Read the parent and child together, then the command line, then Token Elevation Type (%%1937 means Run as administrator). On Windows 10 and later you get the parent's path; older versions give only its PID. If you can run Sysmon, Event ID 1 adds hashes, parent command lines and process GUIDs.

How EpicDetect Can Help

Knowing the fields is step one. Reading a process tree under pressure is the skill. One of our free cases, Macro Click on ws-fin-01, is an endpoint investigation: you work the evidence in an endpoint console, pin what supports your call, and finish with a verdict and IOCs, like a real ticket. If you want a longer story, Adventures Season Zero is five free episodes as a new analyst in your first week.

For the fundamentals in order, the Atlas maps nine zones from foundations through SOC and detection, with the first tier of each zone free. Working toward Security+? The free daily drill and practice test live in the same account, and Premium adds timed exam simulators.

Start free. No card needed.