Windows Security Log · Event 4688

Event 4688: A new process has been created

A program started. This is Windows' own process-creation record, available without installing anything, and it is the backbone of working out what ran on a machine. Whether it includes the command line depends on a Group Policy setting most environments have never turned on.

Also written as 4688Event ID 4688A new process has been createdProcess creation 4688

How oftenFires constantly
Vendor calls itAudit Success
LogSecurity
SourceMicrosoft-Windows-Security-Auditing

What it means for you

On a personal computer

This is off by default on home Windows and you are unlikely to see it. If it is on, it simply records every program that starts — including the dozens Windows launches for itself.

For an analyst

Two settings decide whether this event is worth collecting: the Audit Process Creation subcategory, and the separate 'Include command line in process creation events' policy. Without the second one you get process names with no arguments, which removes most of the detection value. Turn both on, then budget for the volume.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample

A new process has been created.

Creator Subject:
  Security ID:    CORP\jbrooks
  Account Name:   jbrooks
  Account Domain: CORP
  Logon ID:       0x3E9A11

Process Information:
  New Process ID:   0x1cf4
  New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Token Elevation Type: %%1938
  Mandatory Label:  Mandatory Label\Medium Mandatory Level
  Creator Process ID:   0x0d10
  Creator Process Name: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
  Process Command Line: powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3...

The fields that decide it

Everything else in the log line is context.

NewProcessName: Full path of the program that started.
CommandLine: The complete command line including arguments. Only populated when the command-line policy is enabled, and it is where encoded payloads and living-off-the-land abuse become visible.
ParentProcessName: What launched it. The parent-child pair carries more detection value than either process alone.
SubjectUserName: The account the process runs under. A name ending in $ means SYSTEM or a computer account rather than a person.
TokenElevationType: Whether the process holds elevated rights, and how it got them.
MandatoryLabel: The integrity level the process runs at. High or System for anything a standard user launched deserves an explanation.
NewProcessId: The process identifier, in hexadecimal. Note that Windows writes it as hex here while Task Manager shows decimal.

Ordinary reasons this happens

Most of the time it is one of these.

Normal use of the computer — every application launch produces one.
Software updaters, telemetry, and scheduled maintenance, which account for most of the volume on an idle machine.
Management agents and deployment tooling spawning scripts and command shells, which is the main source of false positives.
Login scripts running at sign-in, producing a burst of shell and utility processes.
Developer machines, where build tools spawn hundreds of short-lived children.

When it is not ordinary

A malicious document launching a payload.

What gives it awayThe parent is an Office application and the child is a shell, a scripting engine, or something running from a temporary directory.

ATT&CK T1566.001

Encoded PowerShell hiding the real command.

What gives it awayCommandLine carries an encoded-command flag followed by a long base64 string. Decode it before deciding anything.

ATT&CK T1059.001

Built-in Windows binaries abused to download or run code.

What gives it awaySigned system utilities running with URLs or unusual arguments, launched by a parent with no business doing so.

ATT&CK T1218

Discovery commands run immediately after a foothold.

What gives it awayA rapid sequence of built-in reconnaissance utilities from one parent, all within a few seconds. Humans do not type that fast.

ATT&CK T1087

Persistence being established.

What gives it awayProcesses that register scheduled tasks or services, launched from a user context rather than from installer software.

ATT&CK T1053.005

What to do next

Read the full CommandLine first, and decode any encoded arguments before judging anything.
Walk the parent chain upward until you reach a process you recognise. The origin is what explains the event.
Check whether the executable path is somewhere programs normally live. Temporary directories, user profile folders, and recycle bin paths are the ones to question.
Check TokenElevationType against the account. An elevated process from a standard user needs a reason.
Look at how widely the same process and command line appear. Present on every machine means it is your own tooling; present on one means look harder.
Pull the surrounding minute of 4688 events on the same host — attacker activity is rarely a single process.

Queries to run

kql Office spawning a shell or scripting engine. High value, low noise, and worth alerting on directly.

SecurityEvent | where EventID == 4688 | extend Parent = tostring(split(ParentProcessName, '\\')[-1]), Child = tostring(split(NewProcessName, '\\')[-1]) | where Parent in~ ('winword.exe','excel.exe','powerpnt.exe','outlook.exe') and Child in~ ('cmd.exe','powershell.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe') | project TimeGenerated, Computer, Account, Parent, Child, CommandLine

kql Obfuscated PowerShell. Expect some legitimate hits from management tooling — tune with an exclusion list rather than dropping the rule.

SecurityEvent | where EventID == 4688 | where CommandLine has_any ('-enc', '-EncodedCommand', 'FromBase64String', '-w hidden', 'IEX', 'Invoke-Expression') | project TimeGenerated, Computer, Account, NewProcessName, CommandLine

powershell Local triage on one machine. Data indexes shift between Windows versions — check the XML before trusting the output.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-2)} | ForEach-Object { $x=[xml]$_.ToXml(); [pscustomobject]@{ Time=$_.TimeCreated; User=$x.Event.EventData.Data[1].'#text'; Process=$x.Event.EventData.Data[5].'#text'; Cmd=$x.Event.EventData.Data[8].'#text' } }

splunk Rarest parent-child pairs first. Cheap way to find the unusual without knowing what you are looking for.

index=wineventlog EventCode=4688 | stats count by New_Process_Name, Creator_Process_Name | sort count asc | head 50

Common questions

Why does Event 4688 not show the command line?

Command-line capture is a separate Group Policy setting from process auditing itself. Enable 'Include command line in process creation events' under Administrative Templates, System, Audit Process Creation. Without it you get the executable path and nothing else, which removes most of the value.

What is the difference between Event 4688 and Sysmon Event 1?

Both record process creation. Sysmon adds file hashes, the parent's full command line, the original compiled filename, and a process GUID that stays stable after PIDs are reused. 4688 needs no extra software and is available everywhere, which is its real advantage.

What does Token Elevation Type %%1938 mean?

Type 3, a limited token — the standard, unelevated case for a process launched by a normal user. %%1937 means the process is elevated, and %%1936 means a full token with no UAC split, which is normal for SYSTEM processes and for machines with UAC turned off.

Is Event 4688 safe to enable everywhere?

Functionally yes, but plan for the volume. A busy machine produces thousands per day, and enabling it fleet-wide without checking your log retention or ingestion costs first is the usual way this goes wrong. Turn it on for servers and higher-risk users before turning it on universally.

Mentioned by

Vendor documentation

Last reviewed 28 August 2026