SOC Event Lookup
Event ID 1ProcessP1

Sysmon Event ID 1: Process creation

Applicable version
Sysmon 1.0 and later
Last reviewed
2026-07-21

Quick summary

Sysmon Event ID 1 records process creation and is one of the most important events for reconstructing command execution, parent-child process chains, and suspicious process launches.

Technical Metadata

Technical metadata for Event ID 1
Event ID1
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0002 Execution / T1059.001 PowerShell
Key fields to watchImage, CommandLine, ParentImage / ParentCommandLine, Hashes

Trigger Scenarios

Whenever Sysmon observes a new process start, it records Event ID 1 with process image, command line, parent process, hashes, user, integrity level, and related metadata according to the active Sysmon configuration.

Key Fields

Image

The executable path for the new process. Analysts use this to distinguish expected binaries from unusual paths such as user-writable directories, temp folders, or renamed tools.

CommandLine

The command line used to launch the process. This field is often the strongest signal for suspicious script execution, living-off-the-land abuse, encoded commands, and tool parameters.

ParentImage / ParentCommandLine

The parent process context. Office spawning PowerShell, a service spawning cmd.exe, or a browser spawning a script host can be more suspicious than the child process alone.

Hashes

Configured file hashes for the process image. These help correlate binaries across hosts and support allowlisting, blocklisting, and malware triage workflows.

Threat Hunting Queries

Microsoft Sentinel KQL: Suspicious Sysmon PowerShell process creation
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 1
| where RenderedDescription has_all ("powershell.exe")
| where RenderedDescription has_any ("-EncodedCommand", "-ExecutionPolicy Bypass", "DownloadString")
| project TimeGenerated, Computer, RenderedDescription
Data source
Microsoft Sentinel Event table
Assumptions
The connector collects the Sysmon Operational channel into the Event table and retains RenderedDescription. For parsed Sysmon tables, replace RenderedDescription with the local Image, CommandLine, ParentImage, and ParentCommandLine fields.
Query reference
Splunk SPL: Suspicious Sysmon PowerShell process creation
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\powershell.exe"
| search CommandLine IN ("*-EncodedCommand*", "*-ExecutionPolicy Bypass*", "*DownloadString*")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, ProcessGuid
Data source
Splunk Sysmon event data
Assumptions
The Sysmon add-on or local field extraction exposes XML field names without spaces. Administrative PowerShell usage is baselined before alerting.
Cortex XQL: Retrieve Sysmon Event ID 1 candidates
dataset = microsoft_windows_raw
| filter edr_event_id = 1
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Sysmon Operational channel is ingested into Cortex XDR. Event ID 1 is not globally unique; confirm Provider is Microsoft-Windows-Sysmon in the raw event before applying Sysmon field semantics.
Query reference
Sigma rule: Encoded or policy-bypassing PowerShell process
title: Encoded Or Policy Bypassing PowerShell Process
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    image:
        Image|endswith: '\powershell.exe'
    options:
        CommandLine|contains:
            - '-EncodedCommand'
            - '-ExecutionPolicy Bypass'
    condition: image and options
falsepositives:
    - Approved administrative automation
level: medium
tags:
    - attack.execution
    - attack.t1059.001
Data source
Sigma Windows process_creation log source
Assumptions
The Sigma backend is configured to use Sysmon Event ID 1 for the generic process_creation category.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID1Sysmon process creation event.Provider and channel must also match Sysmon because Event ID values are not globally unique across Windows providers. Source
HashAlgorithms*Sysmon configuration requests all supported hash algorithms.The Hashes field only contains algorithms enabled in configuration, so missing SHA256 data can be a collection configuration issue rather than missing telemetry from the process itself. Source
ProcessGuidGUIDA process identifier designed for correlation even when Windows reuses numeric process IDs.Use it to join the process to Sysmon network, image-load, process-access, and file events without relying only on a reused ProcessId. Source

MITRE ATT&CK Mapping

  • T1059.001PowerShell

Detection Notes

T1059.001 execution is concrete when Image is powershell.exe with -EncodedCommand or -ExecutionPolicy Bypass and CommandLine references C:\\Users\\ or C:\\ProgramData\\. ParentImage WINWORD.EXE or a browser process launching that interpreter is a high-signal chain; join ProcessGuid to Event ID 3 rather than relying on a reused numeric ProcessId.

Common False Positives

  • Administrative scripts and endpoint management tools can generate large volumes of PowerShell, cmd.exe, msiexec.exe, or wmic.exe process creation events.
  • Software installers and update agents often spawn short-lived child processes with complex command lines.
  • Developer workstations can legitimately run interpreters, compilers, shells, and unsigned local tools at high frequency.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-10 03:20:11.123
ProcessGuid: {11111111-2222-3333-4444-555555555555}
ProcessId: 4242
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Users\Public\script.ps1
CurrentDirectory: C:\Users\Public\
User: CORP\jsmith
ParentImage: C:\Windows\System32\cmd.exe
ParentCommandLine: cmd.exe /c powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Users\Public\script.ps1
Hashes: SHA256=REDACTED

Frequently Asked Questions

What does Sysmon Event ID 1 record?

Sysmon Event ID 1 records process creation with extended context such as current and parent command lines, process identifiers, user, integrity context, and configured image hashes.

How is Sysmon Event ID 1 different from Windows Security Event ID 4688?

Both describe process creation, but Sysmon supplies a ProcessGuid, parent command line, and configured hashes in its own Operational channel, while 4688 is generated by Windows Audit Process Creation in the Security channel.

Does Sysmon Event ID 1 identify malicious processes by itself?

No. Sysmon records telemetry and does not classify events as malicious; analysts must evaluate image path, command line, parent relationship, user, integrity, hashes, prevalence, and correlated activity.

Sources