Event ID 4688 — Creating a new process

Windows created a new process when the process creation audit is enabled.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Normal execution of an application
• Script Power Shell
• Automated installation or task

Verifications to be carried out

1. Control New Process Name
2. Read the Parent Process Name when available
3. Examine command line if the corresponding audit is enabled

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 50

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.