Sysmon Event ID 1: Process Creation — Fields, Hunting and KQL

What it records

Sysmon writes Event ID 1 to Microsoft-Windows-Sysmon/Operational each time a process starts on the machine, unless the configuration’s <ProcessCreate> rules filter it out. Microsoft’s description is that it “provides extended information about a newly created process”, and the extension is what makes it the backbone of endpoint investigation: the full CommandLine, Hashes of the executable, its version information (FileVersion, Description, Product, Company and OriginalFileName), and the parent — ParentImage, ParentCommandLine and, in recent schemas, ParentUser.

Three identifiers tie the event to everything else. ProcessGuid is unique to this process; Microsoft designed it for correlation, so the same value appears in the process’s network connections (event 3), file creations (event 11), registry changes (events 12–14) and DNS queries (event 22), and as ParentProcessGuid in its children. LogonId joins the process to the Windows logon session in the Security log. ProcessId is the familiar PID, but PIDs are reused, so use the GUID for joins.

When it matters

Almost every attack that runs code leaves an event 1, and most of the signal is in a few readings:

Pattern	Reading
ParentImage is WINWORD.EXE, EXCEL.EXE, OUTLOOK.EXE or a browser, Image is a shell or script host	A document, attachment or page executing code
CommandLine has -enc, -EncodedCommand, FromBase64String or IEX	Obfuscated PowerShell — decode before judging
certutil -urlcache, bitsadmin /transfer, mshta http…, regsvr32 /i:http…	A Windows binary used to download or run remote code
OriginalFileName differs from the Image file name	A renamed binary (MITRE ATT&CK T1036.003)
Image under \AppData\, \Temp\, \Users\Public\ or \ProgramData\	Programs dropped by users or malware, not installed software
ParentImage is services.exe or wmiprvse.exe and Image is cmd.exe or powershell.exe	Remote execution through a service or WMI
IntegrityLevel High under a user account on a workstation	The user ran something elevated

The parent-child pair carries more than either side alone: powershell.exe under explorer.exe is a user opening a console; the same binary under WINWORD.EXE is a macro.

How to investigate

In Microsoft Sentinel, Sysmon events are rows of the Event table with their fields in the EventData XML. This reads them and finds documents and browsers starting shells:

Event
| where TimeGenerated > ago(7d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 1
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend Image = tostring(f.Image), CommandLine = tostring(f.CommandLine), ParentImage = tostring(f.ParentImage),
         ParentCommandLine = tostring(f.ParentCommandLine), Account = tostring(f.User)
| where ParentImage has_any ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "msedge.exe", "chrome.exe")
| where Image has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, Computer, Account, ParentImage, ParentCommandLine, Image, CommandLine

Renamed binaries — the compiled name of a well-known tool under a different file name:

Event
| where TimeGenerated > ago(30d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 1
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend Image = tostring(f.Image), OriginalFileName = tostring(f.OriginalFileName), Hashes = tostring(f.Hashes)
| extend FileName = tostring(split(Image, "\\")[-1])
| where OriginalFileName in~ ("PowerShell.EXE", "Cmd.Exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "certutil.exe")
| where FileName !~ OriginalFileName
| project TimeGenerated, Computer, Image, OriginalFileName, Hashes

Each hit leads to a session and a tree. Join LogonId to the 4624 with the same Target Logon ID for the logon type and source address; follow ProcessGuid to the process’s network connections, files and DNS queries, and to its children through ParentProcessGuid. Paste encoded command lines into the PowerShell decoder to read them without running them.

If the events you expect are missing, the configuration is the first suspect. A <ProcessCreate onmatch="exclude"> rule that drops a whole folder or product also drops anything an attacker places there. The Windows event 4688 page covers Windows’ own process creation event, useful where Sysmon is not installed.