Windows Event ID 4689 – Security: Process Termination Auditing

Before Event ID 4689 can appear, you must enable process termination auditing through Group Policy or Local Security Policy.

1. Open Local Security Policy by running secpol.msc as administrator
2. Navigate to Local Policies → Audit Policy
3. Double-click Audit process tracking
4. Check both Success and Failure options
5. Click OK and restart the system

For advanced auditing on Windows 10/11 and Server 2019+:

1. Run gpedit.msc as administrator
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Detailed Tracking
4. Enable Audit Process Termination for Success events

# Enable via PowerShell (requires admin rights)
auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable

Once auditing is enabled, Event ID 4689 events will appear in the Security log. Here's how to locate and analyze them:

1. Open Event Viewer by running eventvwr.msc
2. Navigate to Windows Logs → Security
3. In the Actions pane, click Filter Current Log
4. Enter 4689 in the Event IDs field
5. Click OK to filter results

Use PowerShell for more advanced querying:

# Get last 50 process termination events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

# Filter by specific process name
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689} | Where-Object {$_.Message -like "*notepad.exe*"}

# Export to CSV for analysis
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689} -MaxEvents 1000 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\Temp\ProcessTermination.csv" -NoTypeInformation

Use PowerShell to identify unusual process termination patterns that might indicate security issues:

# Group termination events by process name to identify frequently terminating processes
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689} -MaxEvents 5000 | ForEach-Object {
    if ($_.Message -match 'Process Name:\s+(.+?)\r?\n') {
        $matches[1]
    }
} | Group-Object | Sort-Object Count -Descending | Select-Object Name, Count

# Find processes terminated within a specific time window
$StartTime = (Get-Date).AddHours(-24)
$EndTime = Get-Date
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689; StartTime=$StartTime; EndTime=$EndTime} | Format-Table TimeCreated, Message -Wrap

# Identify processes terminated by specific users
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689} | Where-Object {$_.Message -like "*DOMAIN\username*"}

Create a custom PowerShell function for detailed analysis:

function Get-ProcessTerminationDetails {
    param(
        [int]$MaxEvents = 100,
        [string]$ProcessName = "*"
    )
    
    Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689} -MaxEvents $MaxEvents | ForEach-Object {
        $Message = $_.Message
        $ProcessNameMatch = if ($Message -match 'Process Name:\s+(.+?)\r?\n') { $matches[1] } else { "Unknown" }
        $ProcessIdMatch = if ($Message -match 'Process ID:\s+(0x[0-9a-fA-F]+)') { $matches[1] } else { "Unknown" }
        
        if ($ProcessNameMatch -like $ProcessName) {
            [PSCustomObject]@{
                TimeCreated = $_.TimeCreated
                ProcessName = $ProcessNameMatch
                ProcessId = $ProcessIdMatch
                User = if ($Message -match 'Subject:\s+Security ID:\s+(.+?)\r?\n') { $matches[1] } else { "Unknown" }
            }
        }
    }
}

For comprehensive process lifecycle monitoring, configure additional audit settings and correlation with Event ID 4688:

1. Enable command line auditing to capture full process execution details:

# Enable command line process auditing via registry
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord

# Or via Group Policy: Computer Configuration > Administrative Templates > System > Audit Process Creation > Include command line in process creation events

2. Create a PowerShell script to correlate process creation (4688) with termination (4689):

function Get-ProcessLifecycle {
    param([string]$ProcessName)
    
    # Get process creation events
    $CreationEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 1000 | Where-Object {$_.Message -like "*$ProcessName*"}
    
    # Get process termination events
    $TerminationEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689} -MaxEvents 1000 | Where-Object {$_.Message -like "*$ProcessName*"}
    
    # Correlate by Process ID and time
    foreach ($creation in $CreationEvents) {
        $creationPid = if ($creation.Message -match 'New Process ID:\s+(0x[0-9a-fA-F]+)') { $matches[1] }
        $termination = $TerminationEvents | Where-Object {
            $_.Message -match "Process ID:\s+$creationPid" -and $_.TimeCreated -gt $creation.TimeCreated
        } | Select-Object -First 1
        
        if ($termination) {
            $duration = $termination.TimeCreated - $creation.TimeCreated
            [PSCustomObject]@{
                ProcessName = $ProcessName
                ProcessId = $creationPid
                StartTime = $creation.TimeCreated
                EndTime = $termination.TimeCreated
                Duration = $duration.ToString()
            }
        }
    }
}

Set up automated monitoring for suspicious process termination patterns using PowerShell and Task Scheduler:

1. Create a monitoring script that checks for unusual termination patterns:

# ProcessTerminationMonitor.ps1
param(
    [int]$ThresholdCount = 10,
    [int]$TimeWindowMinutes = 60
)

$StartTime = (Get-Date).AddMinutes(-$TimeWindowMinutes)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689; StartTime=$StartTime}

# Check for processes terminating too frequently
$ProcessCounts = $Events | ForEach-Object {
    if ($_.Message -match 'Process Name:\s+(.+?)\r?\n') {
        $matches[1]
    }
} | Group-Object | Where-Object {$_.Count -gt $ThresholdCount}

if ($ProcessCounts) {
    $AlertMessage = "High process termination rate detected:`n"
    $ProcessCounts | ForEach-Object {
        $AlertMessage += "$($_.Name): $($_.Count) terminations`n"
    }
    
    # Send alert (customize as needed)
    Write-EventLog -LogName Application -Source "ProcessMonitor" -EventId 1001 -EntryType Warning -Message $AlertMessage
    
    # Optional: Send email alert
    # Send-MailMessage -To "admin@company.com" -From "monitor@company.com" -Subject "Process Termination Alert" -Body $AlertMessage -SmtpServer "mail.company.com"
}

2. Create a scheduled task to run the monitoring script:

# Create scheduled task for process monitoring
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\ProcessTerminationMonitor.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest

Register-ScheduledTask -TaskName "ProcessTerminationMonitor" -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal

3. Configure Windows Event Forwarding for centralized monitoring:

# Configure WinRM for event forwarding
winrm quickconfig -q
wecutil qc /q

# Create custom event forwarding subscription
$SubscriptionXML = @"

    ProcessTermination
    SourceInitiated
    Forward Process Termination Events
    true
    http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog
    Normal
    
            
                *[System[(EventID=4689)]]
            
        
    ]]>

"@

$SubscriptionXML | Out-File -FilePath "C:\Temp\ProcessTermination.xml"
wecutil cs "C:\Temp\ProcessTermination.xml"