SOC Event Lookup
Event ID 4608SystemP3

Windows Event ID 4608: Windows is starting up

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4608 records startup of LSASS and initialization of the auditing subsystem.

Technical Metadata

Technical metadata for Event ID 4608
Event ID4608
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0040 Impact / T1529 System Shutdown/Reboot
Key fields to watchEventID / TimeCreated, Computer, Sequence with 4609

Trigger Scenarios

Microsoft documents that this event is logged when LSASS.EXE starts and the auditing subsystem initializes, typically during OS startup.

Key Fields

EventID / TimeCreated

Startup timestamp for the audited system, used to anchor boot timelines.

Computer

The host whose auditing subsystem initialized.

Sequence with 4609

Compare with 4609 shutdown and uptime expectations to identify unexpected reboots.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4608
SecurityEvent
| where EventID == 4608
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4608
index=wineventlog source="WinEventLog:Security" EventCode=4608
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4608
dataset = microsoft_windows_raw
| filter edr_event_id = 4608
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4608
title: Windows Security Event ID 4608
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4608
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID4608Windows startup and initialization of the LSA security subsystem.Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source
TimeCreatedUTC timestampThe startup time used for reboot and audit-gap correlation.Interpret TimeCreated with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1529System Shutdown/Reboot

Detection Notes

Use threshold=1 unexpected 4608 outside a maintenance window on servers where reboot should be rare. Microsoft documents 4608 as LSASS/auditing subsystem startup; if no matching 4609 or approved reboot exists and the host later shows cleared logs or service changes, the sequence can support T1529 System Shutdown/Reboot. Correlate TimeCreated with 4616 time changes, 1102 audit-log clears, and service-start events.

Common False Positives

  • Normal OS startup after planned maintenance or patching.
  • Lab and workstation reboots create routine 4608 events.

Related Events

Sample Log

Sanitized event sample
EventID: 4608
Computer: DC01
TimeCreated: 2026-07-13T03:10:00Z

Frequently Asked Questions

What does Windows Event ID 4608 mean?

Windows and the Local Security Authority security subsystem started.

Does Event ID 4608 always indicate malicious activity?

No. It is expected after every normal system startup.

How should Event ID 4608 be investigated?

Compare TimeCreated with maintenance records, boot telemetry, audit gaps, and preceding shutdown or crash evidence.

Sources

Machine-readable JSON