Windows Event ID 4688 — Process Created

MITRE ATT&CK

Why It Matters

Most attacks that execute code on Windows generate 4688 events. Without command-line logging, 4688 shows only the executable name; with it, you see the full command including encoded payloads, remote file paths, and LOLBin-specific flags. Parent-child relationships are the most reliable detection signal: legitimate applications have predictable parents, and deviations — Office spawning PowerShell, explorer.exe launching cmd.exe with base64 arguments — are near-definitive malicious execution indicators.

Key Fields

Investigation Tips

1. 1.Enable command-line logging first — without it, 4688 shows only the executable name and is far less valuable. GPO path: Computer Configuration → Administrative Templates → System → Audit Process Creation → 'Include command line in process creation events' → Enabled.
2. 2.Parent-child anomaly: Office apps (winword.exe, excel.exe, powerpnt.exe, onenote.exe) spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe, or cscript.exe = malicious macro or phishing document execution. Make this a high-priority alert with no exceptions.
3. 3.Encoded PowerShell: look for -EncodedCommand or -enc in the command line. Legitimate PowerShell scripts rarely use encoding; attackers encode to bypass string-matching detection and obscure the payload. Decode with [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('...')) and inspect.
4. 4.LOLBin patterns to alert on: certutil.exe -urlcache or -decode (file download/decode); bitsadmin.exe /transfer (background downloader); regsvr32.exe /s /n /u /i:http (remote scriptlet — Squiblydoo, no disk write); mshta.exe with http:// argument (HTA payload); rundll32.exe executing non-System32 DLLs; wscript.exe/cscript.exe from Temp or AppData.
5. 5.Process masquerading: check that New Process Name paths match expected locations. Legitimate svchost.exe is always in C:\Windows\System32\. Any executable with a system-process name but running from Users\, Temp\, or Desktop\ is masquerading — a common malware technique.
6. 6.PPID spoofing: attackers can forge the parent PID to make malicious code appear as a child of a trusted process (e.g., appearing as a child of explorer.exe). Detect by correlating New Process ID lineage — if the reported parent has no matching 4688 event from the expected time, the parent PID is spoofed.
7. 7.Short-lived encoded processes: 4688 (powershell.exe -enc ...) immediately followed by 4689 (exit) = one-shot command execution. Attackers run a single command and exit to minimize presence in running process lists and reduce dwell time.

Related Event IDs