Windows Event ID 6280 – Microsoft-Windows-Kernel-Process: Process Creation Notification

First, enable the Microsoft-Windows-Kernel-Process/Analytic log to start collecting Event ID 6280:

# Enable the Kernel Process Analytic log
wevtutil sl Microsoft-Windows-Kernel-Process/Analytic /e:true

# Verify the log is enabled
wevtutil gl Microsoft-Windows-Kernel-Process/Analytic

Navigate to Event Viewer to view the events:

Event Viewer → Applications and Services Logs → Microsoft → Windows → Kernel-Process → Analytic

Query recent Event ID 6280 entries using PowerShell:

# Get last 50 process creation events
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Kernel-Process/Analytic'; Id=6280} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Create targeted queries to monitor specific executables or suspicious process patterns:

# Monitor specific executable launches
$FilterXML = @"

  
    
      *[System[EventID=6280]] and 
      *[EventData[Data[@Name='ImageName'] and (contains(., 'powershell.exe') or contains(., 'cmd.exe'))]]
    
  

"@

Get-WinEvent -FilterXml $FilterXML -MaxEvents 25

Monitor processes launched from suspicious directories:

# Check for processes from temp directories
$Events = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Kernel-Process/Analytic'; Id=6280} -MaxEvents 100
$Events | Where-Object {$_.Message -match "\\temp\\|\\appdata\\local\\temp\\"} | Select-Object TimeCreated, Message

Export filtered results for analysis:

# Export suspicious process events to CSV
$SuspiciousEvents = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Kernel-Process/Analytic'; Id=6280} -MaxEvents 1000 |
  Where-Object {$_.Message -match "powershell|cmd|wscript|cscript"}
$SuspiciousEvents | Export-Csv -Path "C:\temp\process_events.csv" -NoTypeInformation

Extract and analyze process hierarchy information from Event ID 6280 to identify process spawning patterns:

# Parse process creation events for parent-child relationships
$ProcessEvents = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Kernel-Process/Analytic'; Id=6280} -MaxEvents 500

$ProcessData = foreach ($Event in $ProcessEvents) {
    $XML = [xml]$Event.ToXml()
    $EventData = $XML.Event.EventData.Data
    
    [PSCustomObject]@{
        TimeCreated = $Event.TimeCreated
        ProcessId = ($EventData | Where-Object {$_.Name -eq 'ProcessId'}).InnerText
        ParentProcessId = ($EventData | Where-Object {$_.Name -eq 'ParentProcessId'}).InnerText
        ImageName = ($EventData | Where-Object {$_.Name -eq 'ImageName'}).InnerText
        CommandLine = ($EventData | Where-Object {$_.Name -eq 'CommandLine'}).InnerText
    }
}

# Display process tree
$ProcessData | Sort-Object TimeCreated | Format-Table -AutoSize

Identify processes with unusual parent relationships:

# Find processes spawned by unexpected parents
$UnusualParents = $ProcessData | Where-Object {
    ($_.ImageName -match "powershell.exe" -and $_.ParentProcessId -notmatch "explorer.exe|cmd.exe") -or
    ($_.ImageName -match "cmd.exe" -and $_.ParentProcessId -match "winword.exe|excel.exe|outlook.exe")
}

$UnusualParents | Format-Table TimeCreated, ImageName, ParentProcessId -AutoSize

Set up comprehensive ETW logging with custom log size and retention policies:

# Configure log size and retention
wevtutil sl Microsoft-Windows-Kernel-Process/Analytic /ms:104857600  # 100MB
wevtutil sl Microsoft-Windows-Kernel-Process/Analytic /rt:false      # Disable real-time

# Create scheduled task for log rotation
$Action = New-ScheduledTaskAction -Execute "wevtutil" -Argument "cl Microsoft-Windows-Kernel-Process/Analytic"
$Trigger = New-ScheduledTaskTrigger -Daily -At "02:00AM"
$Settings = New-ScheduledTaskSettingsSet -RunOnlyIfNetworkAvailable:$false
Register-ScheduledTask -TaskName "RotateKernelProcessLog" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

Create custom event forwarding for centralized monitoring:

# Save as ProcessCreation.xml for event forwarding
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>ProcessCreationEvents</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Forward Process Creation Events</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <Query>
        <![CDATA[
        <QueryList>
            <Query Id="0">
                <Select Path="Microsoft-Windows-Kernel-Process/Analytic">*[System[EventID=6280]]</Select>
            </Query>
        </QueryList>
        ]]>
    </Query>
</Subscription>

Deploy the subscription:

# Create event subscription
wecutil cs ProcessCreation.xml

Create PowerShell-based monitoring script for real-time threat detection:

# Advanced threat detection script
$LogName = 'Microsoft-Windows-Kernel-Process/Analytic'
$EventId = 6280

# Define suspicious patterns
$SuspiciousPatterns = @(
    '.*\\temp\\.*\.exe',
    '.*powershell.*-enc.*',
    '.*cmd.*\/c.*echo.*',
    '.*wscript.*\.vbs',
    '.*regsvr32.*scrobj.dll'
)

# Monitor for new events
Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='$LogName' AND EventCode=$EventId" -Action {
    $Event = $Event.SourceEventArgs.NewEvent
    $Message = $Event.Message
    
    foreach ($Pattern in $SuspiciousPatterns) {
        if ($Message -match $Pattern) {
            Write-Host "[ALERT] Suspicious process detected: $Message" -ForegroundColor Red
            # Add alerting logic here (email, SIEM, etc.)
            break
        }
    }
}

Write-Host "Process monitoring active. Press Ctrl+C to stop."
try { while ($true) { Start-Sleep 1 } }
finally { Get-EventSubscriber | Unregister-Event }

Configure Windows Performance Toolkit (WPT) for advanced analysis:

# Create custom ETW session for detailed process tracking
$SessionName = "ProcessMonitoring"
$ETLFile = "C:\temp\process_trace.etl"

# Start ETW session
logman create trace $SessionName -p Microsoft-Windows-Kernel-Process -o $ETLFile -ets

# Stop session after collection period
# logman stop $SessionName -ets