Event ID 4688: A New Process Has Been Created — Fields and Hunting

What it records

Event 4688 belongs to the Audit Process Creation subcategory, and Microsoft’s description is short: “This event generates every time a new process starts.” It is written on the machine where the process ran — a workstation, a server or a domain controller — so it is the closest thing Windows has to a built-in execution log.

The record answers four questions. What ran: New Process Name is the full path of the executable, and New Process ID its hexadecimal PID. Who started it: Creator Process ID and, on Windows 10 and later, Creator Process Name identify the parent process. As whom: the Creator Subject section names the account and Logon ID of the session that asked for the process; when the new process runs under a different logon, Windows 10 adds a Target Subject section with that account. With what privilege: Token Elevation Type records whether the token was full (%%1936), elevated (%%1937) or limited (%%1938), and Mandatory Label the integrity level, from untrusted (S-1-16-0) to protected process (S-1-16-20480).

The field that matters most is often missing. Process Command Line “contains the name of executable and arguments which were passed to it”, but Microsoft states that by default the field is empty: the group policy Include command line in process creation events has to be enabled first. Many environments collect 4688 for years without it and only see that powershell.exe ran, never what it was told to do.

When it matters

Almost every attack that executes code on a Windows host leaves a 4688 — if process creation auditing is on. The patterns to recognise:

Pattern	Reading
A shell or script host (cmd.exe, powershell.exe, wscript.exe, mshta.exe) whose Creator Process Name is Word, Excel or Outlook	A malicious document or attachment running code
Command lines with -EncodedCommand / -enc, FromBase64String or IEX	Obfuscated PowerShell — decode it before judging
certutil -urlcache, bitsadmin /transfer, mshta http…, rundll32 with a URL or script	A built-in binary used to download or proxy-execute code
New Process Name under AppData, Temp, Users\Public or ProgramData	Microsoft’s recommendation: watch processes outside System32 and Program Files
Process names containing mimikatz or other tool names	Microsoft’s own example of a restricted substring to check
Token Elevation Type %%1936 for a real user account	Microsoft: UAC is likely disabled for that account
Token Elevation Type %%1937 on a standard workstation	Microsoft: a user ran a program with administrative privileges
wevtutil cl, vssadmin delete shadows, bcdedit	Log clearing and recovery tampering — check for event 1102 (audit log cleared)

The parent-child relationship carries most of the signal. powershell.exe started by explorer.exe is a user opening a console; the same binary started by WINWORD.EXE is a document executing code. Likewise, the account matters: a process created under a service account that normally runs one binary, or under a local account on a domain-joined machine, deserves a second look.

How to investigate

Before hunting, check that the data exists and that command lines are populated:

SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4688
| summarize Events = count(), WithCommandLine = countif(isnotempty(CommandLine)) by Computer
| extend CommandLineCoverage = round(100.0 * WithCommandLine / Events, 1)
| order by CommandLineCoverage asc

Hosts at 0% need the Include command line in process creation events policy. Then look for documents and browsers starting shells and script hosts:

SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where ParentProcessName has_any ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "msedge.exe", "chrome.exe")
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine, SubjectLogonId
| order by TimeGenerated desc

Encoded and download-style command lines:

SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where CommandLine has_any ("-enc ", "-EncodedCommand", "FromBase64String", "IEX", "DownloadString", "urlcache", "/transfer")
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc

Paste any encoded payload into the PowerShell EncodedCommand decoder to read it without running it. To surface what is new rather than what is noisy, stack executables by how rarely they run across the estate:

SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 4688
| summarize Hosts = dcount(Computer), Runs = count(), Accounts = make_set(SubjectUserName, 5), LastSeen = max(TimeGenerated)
    by NewProcessName
| where Hosts <= 2
| order by LastSeen desc

Each hit leads back to a session: join the SubjectLogonId to the 4624 with the same Target Logon ID to get the logon type and source address, and check 4672 for special privileges on that logon. Follow New Process ID forward to the children the process started. Elevated sessions are worth filtering on directly — TokenElevationType == "%%1937" on workstations shows programs users ran as administrator. For a single machine with no SIEM, export the Security log as XML and load it into the free browser log analyzer, which flags suspicious command lines.