EventID 4688: A new process has been created

This event, logged to the Security channel, indicates a process was created on the system.

This event requires the Audit Process Creation policy to be configured, which is by default not configured.

Analysis Value

Logon IDSecurity IdentifierCommand Line OptionsExecution AccountParent and Child InformationEvidence of ExecutionExecution Timestamp

Operating System Availability

Major Version	Support	Major Version	Support
Windows 11	⚠️	Server 2019	⚠️
Windows 10	⚠️	Server 2016	⚠️
Windows 8	⚠️	Server 2012	⚠️
Windows 7	⚠️	Server 2008	⚠️
Windows Vista	⚠️	Server 2003	⚠️
Windows XP	⚠️

In Windows XP/Windows Server 2003, the corresponding Event ID is 592.

For the events to contain the full command line for each logged process, an additional policy called Include command line in process creation events must also be configured.

Artifact Location(s)

• %SystemRoot%\System32\Winevt\Logs\Security.evtx

Artifact Interpretation

Field	Interpretation	Reference
EventData/SubjectLogonId	Provides the LogonID of the account that spawned the new process	Logon ID
EventData/NewProcessName	Provides the full path of the application that was spawned	File Path
EventData/CommandLine	The command line that spawned the new process	Command Line Options
EventData/SubjectUserSid	The SID of the account that spawned the process	Security Identifier
EventData/SubjectUserName	The username of the account that spawned the new process	Username
EventData/SubjectDomainName	The domain name of the account that spawned the new process, if it exists. If the user is not a domain user, this field will be -
EventData/TokenElevationType	The token elevation type, related to UAC (see Analysis Tips)
EventData/NewProcessID	The process ID of the newly spawned process	Parent and Child Information
EventData/ProcessID	The process ID of the parent process	Parent and Child Information

Analysis Tips

TokenElevationType and UAC

The EventData\TokenElevationType field relates to UAC. The following interpretations are made possible by this field:

• %%1936 indicates that UAC is disabled on the system, or that the local administrator account launched the process.

• %%1937 indicates that the user manually ran the process as an administrator, or that the program requested administrative privileges upon execution.

• %%1938 indicates that the process did not run with administrator privileges.

In the event that UAC was used to elevate permissions in order to execute an application, this information will be stored in the Target fields instead.

Command Line Options

In the event that Process Tracking is enabled (defaults to disabled), the full command line will be available in the Process Command Line field.

In order for this to be available, the system's policy must be enabled under Computer Configuration/Administrative Templates/System/Audit Process Creation/Include command line in process creation events.

Process Tree

The ProcessID and NewProcessID fields may be used to create a timeline of processes.

Examples

In the following example, notepad.exe was launched by a user through Explorer.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" /> 
  <EventID>4688</EventID> 
  <Version>2</Version> 
  <Level>0</Level> 
  <Task>13312</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8020000000000000</Keywords> 
  <TimeCreated SystemTime="2023-06-25T19:46:45.3571632Z" /> 
  <EventRecordID>16044222</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="7776" /> 
  <Channel>Security</Channel> 
  <Computer>HLPC01</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-5-21-3471133136-2963561160-3931775028-1001</Data> 
  <Data Name="SubjectUserName">john.doe</Data> 
  <Data Name="SubjectDomainName">HLPC01</Data> 
  <Data Name="SubjectLogonId">0xd91ae</Data> 
  <Data Name="NewProcessId">0x5194</Data> 
  <Data Name="NewProcessName">C:\Windows\System32\notepad.exe</Data> 
  <Data Name="TokenElevationType">%%1938</Data> 
  <Data Name="ProcessId">0x25d0</Data> 
  <Data Name="CommandLine">"C:\Windows\system32\notepad.exe"</Data> 
  <Data Name="TargetUserSid">S-1-0-0</Data> 
  <Data Name="TargetUserName">-</Data> 
  <Data Name="TargetDomainName">-</Data> 
  <Data Name="TargetLogonId">0x0</Data> 
  <Data Name="ParentProcessName">C:\Windows\explorer.exe</Data> 
  <Data Name="MandatoryLabel">S-1-16-8192</Data> 
  </EventData>
  </Event>

This example was produced on Windows 10, Version 10.0.19044 Build 19044

In the following example, regedit.exe was launched by a user through the command line. Note the TokenElevationType has a value of %%1937, indicating they were likely prompted for administrative credentials/permissions. This also causes the user information to be stored in the Target fields, as opposed to the Subject fields as seen in the previous example.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" /> 
  <EventID>4688</EventID> 
  <Version>2</Version> 
  <Level>0</Level> 
  <Task>13312</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8020000000000000</Keywords> 
  <TimeCreated SystemTime="2023-06-25T19:48:53.8848049Z" /> 
  <EventRecordID>16044760</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="9852" /> 
  <Channel>Security</Channel> 
  <Computer>HLPC01</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-5-18</Data> 
  <Data Name="SubjectUserName">HLPC01$</Data> 
  <Data Name="SubjectDomainName">WORKGROUP</Data> 
  <Data Name="SubjectLogonId">0x3e7</Data> 
  <Data Name="NewProcessId">0x4c7c</Data> 
  <Data Name="NewProcessName">C:\Windows\regedit.exe</Data> 
  <Data Name="TokenElevationType">%%1937</Data> 
  <Data Name="ProcessId">0x4e24</Data> 
  <Data Name="CommandLine">"C:\Windows\regedit.exe"</Data> 
  <Data Name="TargetUserSid">S-1-5-21-3471133136-2963561160-3931775028-1001</Data> 
  <Data Name="TargetUserName">john.doe</Data> 
  <Data Name="TargetDomainName">HLPC01</Data> 
  <Data Name="TargetLogonId">0xd9173</Data> 
  <Data Name="ParentProcessName">C:\Windows\System32\cmd.exe</Data> 
  <Data Name="MandatoryLabel">S-1-16-12288</Data> 
  </EventData>
  </Event>

This example was produced on Windows 10, Version 10.0.19044 Build 19044