Sysmon · Event 1

Sysmon Event 1: Process creation

A program started. Sysmon records the full command line, who launched it, what launched it, and the file hash. This is the single most useful event for working out what actually happened on a Windows machine.

Also written as Sysmon 1Sysmon Event ID 1Process CreateProcessCreate

How oftenFires constantly
Vendor calls itInformation
LogMicrosoft-Windows-Sysmon/Operational
SourceMicrosoft-Windows-Sysmon

What it means for you

On a personal computer

You will only see these if you installed Sysmon deliberately. It is a free Microsoft tool that keeps a detailed diary of every program that runs — useful after something goes wrong, but it does not block anything by itself.

For an analyst

Your detection quality is bounded by your Sysmon config, not by the event. Start from a maintained community configuration and tune the exclusions; a default install will drown your indexer and an over-filtered one will hide the thing you needed.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample

Process Create:
  UtcTime: 2026-08-28 09:14:02.118
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  FileVersion: 10.0.19041.1
  OriginalFileName: PowerShell.EXE
  CommandLine: powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3...
  CurrentDirectory: C:\Users\jbrooks\Documents\
  User: CORP\jbrooks
  IntegrityLevel: Medium
  Hashes: SHA256=0000000000000000000000000000000000000000000000000000000000000000
  ParentImage: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
  ParentCommandLine: "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" /n "C:\Users\jbrooks\Downloads\invoice.docm"

The fields that decide it

Everything else in the log line is context.

Image: Full path of the program that started.
CommandLine: The complete command line including arguments. This is where encoded payloads, download cradles, and living-off-the-land abuse become visible.
ParentImage: What launched it. The parent-child relationship carries more detection value than either process alone.
OriginalFileName: The name the binary was compiled with, taken from its PE header. It does not change when someone renames the file, so it catches a renamed copy of a known tool.
Hashes: File hashes for reputation lookup and for pinning down exactly which build ran.
IntegrityLevel: The privilege level the process runs at.
User: The account context the process runs under.
ProcessGuid: A unique identifier that stays stable even after PIDs are recycled. Use it to stitch a process to its network connections and file writes.

Ordinary reasons this happens

Most of the time it is one of these.

Ordinary use of the computer — every application launch produces one.
Software updaters, telemetry, and scheduled maintenance tasks, which run constantly and account for most of the volume.
Management agents and deployment tooling spawning scripts, which look remarkably like attacker behaviour and are the main source of false positives.
Developer workflows, where compilers and shells spawn hundreds of short-lived children.

When it is not ordinary

Malicious document dropping a payload.

What gives it awayParentImage is an Office application and the child is a shell, scripting engine, or something in a temp directory.

ATT&CK T1566.001

Encoded PowerShell used to hide the real command.

What gives it awayCommandLine contains an encoded-command flag followed by a long base64 blob. Decode it before deciding anything.

ATT&CK T1059.001

Credential theft from LSASS.

What gives it awayAny process opening or dumping lsass.exe. Pair this with Sysmon Event 10 for the full picture.

ATT&CK T1003.001

A known tool renamed to blend in.

What gives it awayImage and OriginalFileName disagree — the file on disk is called something innocuous but was compiled as something else.

ATT&CK T1036.005

Built-in Windows binaries abused to download or execute code.

What gives it awaySigned system utilities running with URLs or unusual arguments, launched from a parent that has no business doing so.

ATT&CK T1218

What to do next

Read the full CommandLine before anything else. Decode any encoded arguments.
Walk the parent chain upward until you reach something you recognise. The origin explains the event.
Compare Image against OriginalFileName to catch a renamed binary.
Pivot on ProcessGuid to pull the network connections and file writes from the same process.
Check whether the same Image and CommandLine pattern appears across many hosts. Widespread means it is probably your own tooling; isolated means look harder.
Check IntegrityLevel against the user. An elevated process launched by a standard user account needs an explanation.

Queries to run

kql Office applications spawning children — one of the highest-value, lowest-noise detections available.

Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 1 | extend Parent = tostring(split(ParentImage, '\\')[-1]), Child = tostring(split(Image, '\\')[-1]) | where Parent in ('winword.exe','excel.exe','outlook.exe') | project TimeGenerated, Computer, Parent, Child, CommandLine

sigma Portable across backends. Expect some legitimate hits from management tooling; tune with an exclusion list, not by dropping the rule.

detection:
  selection:
    EventID: 1
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
  condition: selection

Common questions

Do I need Sysmon if I already have antivirus?

They do different jobs. Antivirus tries to stop things; Sysmon records what happened in enough detail to reconstruct it afterwards. Sysmon blocks nothing on its own, which is exactly why it is useful — it keeps recording even when something got past your defences.

Why does Sysmon Event 1 generate so many logs?

It records every process that starts, and a normal Windows machine starts hundreds per hour. The volume is controlled through the Sysmon configuration file, which lets you exclude known-good software. Run a maintained community config rather than the default.

What is the difference between Sysmon Event 1 and Windows Event 4688?

Both record process creation, but Sysmon adds file hashes, the parent command line, the original compiled filename, and a stable process GUID. Event 4688 is built into Windows and needs no extra software; Sysmon gives you materially more to investigate with.

Mentioned by

Vendor documentation

Last reviewed 28 August 2026