SOC Event Lookup
Event ID 4688ProcessP1

Windows Event ID 4688: A new process has been created

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4688 records process creation and is a foundational telemetry source for identifying command execution, suspicious parent-child relationships, and attacker tooling.

Technical Metadata

Technical metadata for Event ID 4688
Event ID4688
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0002 Execution / T1059.001 PowerShell
Key fields to watchNew Process Name, Process Command Line, Creator Process Name / Process ID, Subject User Name

Trigger Scenarios

The event is generated when a process starts and Process Creation auditing is enabled. Full command-line capture additionally requires the relevant audit policy setting.

Key Fields

New Process Name

The executable path of the started process. Paths in user-writable directories, temporary folders, or unusual network locations merit additional context.

Process Command Line

The launch arguments. This is often the strongest indicator for encoded PowerShell, LOLBin abuse, suspicious download commands, and tool-specific behavior.

Creator Process Name / Process ID

The parent context and parent process identifier. Unusual parent-child pairs, such as Office applications launching script interpreters, are valuable detection signals.

Subject User Name

The security principal that created the process. This supports attribution and helps differentiate administrative automation from user-driven execution.

Threat Hunting Queries

Microsoft Sentinel KQL: Suspicious PowerShell process creation
SecurityEvent
| where EventID == 4688
| where NewProcessName endswith @"\powershell.exe"
| where CommandLine has_any ("-EncodedCommand", "-ExecutionPolicy Bypass", "DownloadString")
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Include command line in process creation events policy is enabled; otherwise CommandLine is empty. The Windows security connector maps version 2 fields to NewProcessName, CommandLine, and ParentProcessName.
Query reference
Splunk SPL: Suspicious PowerShell process creation
index=wineventlog source="WinEventLog:Security" EventCode=4688 NewProcessName="*\\powershell.exe"
| search CommandLine IN ("*-EncodedCommand*", "*-ExecutionPolicy Bypass*", "*DownloadString*")
| table _time, host, SubjectUserName, NewProcessName, CommandLine, ParentProcessName
Data source
Splunk Windows Security event data
Assumptions
Field aliases vary by Splunk add-on and must be mapped to the Windows XML names. Command-line auditing is enabled on the endpoint.
Cortex XQL: Retrieve process-creation audit events
dataset = microsoft_windows_raw
| filter edr_event_id = 4688
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Windows Security logs are ingested into Cortex XDR. Inspect raw NewProcessName, CommandLine, ParentProcessName, and TokenElevationType values because parsed raw-field names can vary by collection path.
Query reference
Sigma rule: Encoded or policy-bypassing PowerShell process
title: Encoded Or Policy Bypassing PowerShell Process
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    image:
        Image|endswith: '\powershell.exe'
    options:
        CommandLine|contains:
            - '-EncodedCommand'
            - '-ExecutionPolicy Bypass'
    condition: image and options
falsepositives:
    - Approved administrative automation
level: medium
tags:
    - attack.execution
    - attack.t1059.001
Data source
Sigma Windows process_creation log source
Assumptions
The Sigma backend maps generic Image and CommandLine fields to Event ID 4688 or another configured process-creation source.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
TokenElevationType%%1937Type 2: an elevated token with no privileges removed or groups disabled.On a standard workstation it identifies a process explicitly running with administrative privileges and should be assessed against the user and parent process. Source
MandatoryLabelS-1-16-12288High integrity level (RID 0x00003000).A high-integrity scripting process provides context for elevated execution but is not malicious without command-line, user, and parent evidence. Source
CommandLineemptyThe field is empty by default unless command-line process auditing is enabled.An empty value prevents argument-level detections, so telemetry configuration must be checked before treating missing arguments as benign. Source

MITRE ATT&CK Mapping

  • T1059.001PowerShell

Detection Notes

T1059.001 becomes concrete when New Process Name is powershell.exe and Command Line contains -EncodedCommand, -ExecutionPolicy Bypass, or a path under C:\\Users\\, C:\\ProgramData\\, or C:\\Temp\\. Office or browser Parent Process Name launching that child is a high-signal chain, especially with Token Elevation Type %%1937 or high-integrity Mandatory Label S-1-16-12288.

Common False Positives

  • Endpoint management and software deployment systems create large volumes of command interpreters and installers.
  • Developers and administrators may legitimately run scripting engines, compilers, and diagnostics.
  • Some environments omit command-line capture, reducing the usefulness of basic process-name detections.

Related Events

Sample Log

Sanitized event sample
New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Process Command Line: powershell.exe -NoProfile -EncodedCommand <redacted>
Creator Process Name: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Subject User Name: CORP\jsmith

Frequently Asked Questions

What does Windows Event ID 4688 record?

Event ID 4688 records the creation of a new process when Audit Process Creation is enabled, including the creator identity, executable path, process identifiers, and version-dependent process context.

Why is the Process Command Line field empty in Event ID 4688?

Windows leaves Process Command Line empty by default. The administrative policy Include command line in process creation events must be enabled to populate it.

Does PowerShell in Event ID 4688 automatically indicate an attack?

No. PowerShell is widely used for administration; suspiciousness comes from arguments such as encoded commands, an unexpected parent process, user-writable paths, elevation context, and related PowerShell or network events.

Sources