Windows Event ID 4688 – Microsoft-Windows-Security-Auditing: Process Creation Audit Event

Before Event ID 4688 appears, you must enable process creation auditing through Group Policy:

1. Open Group Policy Management Console or run gpedit.msc for local policy
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Detailed Tracking
3. Double-click Audit Process Creation
4. Check Configure the following audit events and select Success
5. To capture command line arguments, also enable: Computer Configuration → Administrative Templates → System → Audit Process Creation → Include command line in process creation events
6. Run gpupdate /force to apply the policy immediately

Verify the setting with PowerShell:

auditpol /get /subcategory:"Process Creation"

Use PowerShell to retrieve and analyze Event ID 4688 entries:

# Get recent process creation events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 50

# Filter by specific process name
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -like "*powershell.exe*"}

# Get events from last 24 hours with details
$StartTime = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime} | Select-Object TimeCreated, Id, @{Name='ProcessName';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*New Process Name:*'}) -replace '.*New Process Name:\s*',''}}

In Event Viewer, navigate to Windows Logs → Security and filter for Event ID 4688. Create a custom view by right-clicking Security → Filter Current Log → enter 4688 in Event IDs field.

Investigate suspicious process creation patterns using advanced PowerShell analysis:

# Find processes launched by specific users
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $subjectUserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
    $processName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessName'} | Select-Object -ExpandProperty '#text'
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        User = $subjectUserName
        Process = $processName
    }
} | Where-Object {$_.User -eq 'suspicious_user'}

# Detect unusual process parent-child relationships
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 1000
$Events | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $parentProcess = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ParentProcessName'} | Select-Object -ExpandProperty '#text'
    $childProcess = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessName'} | Select-Object -ExpandProperty '#text'
    "$parentProcess -> $childProcess"
} | Group-Object | Sort-Object Count -Descending

Set up Windows Event Forwarding (WEF) to centralize 4688 events and reduce noise:

1. Create a custom XML filter to exclude common system processes:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4688)]] and
      *[EventData[Data[@Name='NewProcessName'] and (not(contains(., 'svchost.exe')) and not(contains(., 'dwm.exe')) and not(contains(., 'csrss.exe')))]]
    </Select>
  </Query>
</QueryList>

2. Configure Event Forwarding on the collector server:

# Enable WinRM on source computers
winrm quickconfig

# Create subscription on collector
wecutil cs ProcessCreationSubscription.xml

# Check subscription status
wecutil gr ProcessCreationSubscription

Create a registry key to optimize event collection performance:

HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\MaxSize = 1048576000

Create automated monitoring for suspicious process creation patterns:

# PowerShell script for continuous monitoring
$SuspiciousProcesses = @('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe')
$AlertThreshold = 10

Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStartTrace" -Action {
    $Process = $Event.SourceEventArgs.NewEvent
    if ($SuspiciousProcesses -contains $Process.ProcessName) {
        $Count = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddMinutes(-5)} | 
                 Where-Object {$_.Message -like "*$($Process.ProcessName)*"}).Count
        
        if ($Count -gt $AlertThreshold) {
            Write-EventLog -LogName Application -Source "Security Monitor" -EventId 9999 -EntryType Warning -Message "High volume of $($Process.ProcessName) executions detected: $Count in 5 minutes"
        }
    }
}

# Create scheduled task for regular analysis
$Action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\ProcessMonitor.ps1'
$Trigger = New-ScheduledTaskTrigger -Daily -At 9am
Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName "ProcessCreationMonitor" -Description "Monitor Event ID 4688 for security analysis"