Windows EventInformation
Windows Event ID 6280 – Microsoft-Windows-Kernel-Process: Process Creation Notification
Event ID 6280 records process creation events in the Microsoft-Windows-Kernel-Process ETW provider, capturing detailed process startup information for security monitoring and system analysis.
