Event ID 4689ProcessP2

Windows Event ID 4689: A process has exited

Event ID 4689 records process termination and completes host process-lifetime timelines.

Applicable version: Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed: 2026-07-11

Trigger Scenarios

Windows logs it when an audited process exits.

Key Fields

Process Name

The terminated executable path.

Process ID

Join to 4688, accounting for PID reuse.

Subject

The security context of the ending process.

Common False Positives

Routine process termination is high volume.
Short-lived installers and scripts can create bursts.

Related Events

4688 - A new process has been created

MITRE ATT&CK Mapping

T1070.004Indicator Removal: File Deletion

Detection Notes

For T1070.004, use the 4688/4689 Process ID pair and a short lifetime such as under 60 seconds after wevtutil.exe, del.exe, or cipher.exe execution. PID reuse means the process name and close timestamp must match; termination alone is not evidence of cleanup. Use timeout=60 seconds as an initial short-lifetime triage value.

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4689
| project TimeGenerated, Computer, Account, Process, ProcessId

Splunk SPL

index=wineventlog EventCode=4689 | table _time, host, Process_Name, Process_ID

Sample Log

Process Name: C:\Users\Public\tool.exe
Process ID: 4242

Source

Official documentation Machine-readable JSON