Event ID 4688: a new process has been created

Event 4688 records every program that starts: which program, started by which parent, as which user, with which rights – and, if you switch it on, the full command line. It is off by default. On a Server it is one of the most valuable events for finding out what an attacker actually ran, but it is also noisy, so switch it on deliberately.

In short

What it is: a process started. Its end is Event 4689.
Off by default: audit subcategory Process Creation, plus a separate policy for the command line.
Key fields: New Process Name, Creator (parent) Process Name, Process Command Line, Token Elevation Type, the user.
Suspicious: Office or a browser starting cmd.exe / powershell.exe, -enc (encoded) commands, programs from Temp or Downloads, vssadmin delete shadows.

1. Switch it on, with command lines

As administrator:

auditpol /set /subcategory:"{0CCE922B-69AE-11D9-BED3-505054503030}" /success:enable
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

In Group Policy: Advanced Audit Policy Configuration › Detailed Tracking › Audit Process Creation = Success, and Administrative Templates › System › Audit Process Creation › Include command line in process creation events = Enabled.

Two cautions: command lines can contain passwords people typed into scripts – only administrators can read the Security log, keep it that way. And a busy Server starts thousands of processes a day, so make the Security log bigger.

2. The fields that matter

New Process Name (NewProcessName) and Process Command Line (CommandLine).
Creator Process Name (ParentProcessName): the parent – the most useful field for spotting odd chains.
Subject / Target Subject: the user who started it.
Token Elevation Type (TokenElevationType): %%1936 full token (UAC off or built-in Administrator), %%1937 elevated (Run as administrator), %%1938 limited.

3. PowerShell: odd parent / child chains and encoded commands

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
$office = 'winword.exe','excel.exe','powerpnt.exe','outlook.exe','msedge.exe','chrome.exe','firefox.exe','w3wp.exe','sqlservr.exe'
$shells = 'cmd.exe','powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-4)} -ErrorAction SilentlyContinue |
  ForEach-Object { $f = Get-EventFields $_; $child = Split-Path $f.NewProcessName -Leaf; $parent = Split-Path $f.ParentProcessName -Leaf
    if (($office -contains $parent -and $shells -contains $child) -or $f.CommandLine -match '\s-e(nc|ncodedcommand)?\s' -or $f.NewProcessName -match '\\(Temp|Downloads)\\') {
      [pscustomobject]@{ Time = $_.TimeCreated; User = $f.SubjectUserName; Parent = $parent; Process = $child; CommandLine = $f.CommandLine } } } |
  Format-List

4. Command lines that point to an attack

powershell -enc ... / -EncodedCommand, IEX (New-Object Net.WebClient).DownloadString(...) – hidden or downloaded scripts.
vssadmin delete shadows, wbadmin delete catalog, bcdedit /set recoveryenabled no – ransomware removing your way back.
net user ... /add, net localgroup administrators ... /add – new accounts (4720, 4732).
wevtutil cl – clearing logs (1102).
rundll32 or regsvr32 loading a file from a user folder or a URL; certutil -urlcache downloading a file.

5. Let Coinetic watch it for you

Coinetic keeps the network side of a Server or PC in shape, so attackers rarely get as far as this:

A security check with plain explanations: open ports, risky settings and firewall rules nobody needs any more – each with a severity and a fix you can undo.
Firewall change watch: if something switches the firewall off or opens a port to everyone, Coinetic alerts you and names the program.
Logging kept on: Coinetic keeps the audit settings and the Security log size it needs, and reports audit settings that flood the log.
Ask AI (Pro + AI): “Which finding of the security check should I fix first, and why?”

Protect this Server or PC in 5 minutes

Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.

Start the free 30-day trial →

More guides: all Coinetic guides.

Frequently asked

Why is the command line empty?

The audit subcategory alone logs only the program. The command line needs the separate policy "Include command line in process creation events" (see above).

Will 4688 slow my Server down?

Writing the events costs little; the main cost is log size. Make the Security log bigger or forward the events to a central collector.

What is Event 4689?

A process has exited. It is in the separate subcategory Process Termination and is rarely needed.