SOC Event Lookup
Event ID 4689ProcessP2

Windows Event ID 4689: A process has exited

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4689 records process termination and completes host process-lifetime timelines.

Technical Metadata

Technical metadata for Event ID 4689
Event ID4689
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKNo reliable mapping listed
Key fields to watchProcess Name, Process ID, Subject, Exit Status

Trigger Scenarios

Windows logs it when an audited process exits.

Key Fields

Process Name

The terminated executable path.

Process ID

Join to 4688, accounting for PID reuse.

Subject

The security context of the ending process.

Exit Status

The hexadecimal process exit result. Status 0x0 indicates successful termination but does not describe whether the process's prior activity was benign.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4689
SecurityEvent
| where EventID == 4689
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4689
index=wineventlog source="WinEventLog:Security" EventCode=4689
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4689
dataset = microsoft_windows_raw
| filter edr_event_id = 4689
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4689
title: Windows Security Event ID 4689
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4689
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
ExitStatus0x0The process reported successful termination.The status helps explain termination but does not establish whether prior process activity was benign or malicious. Source

MITRE ATT&CK Mapping

No reliable mapping listed.

Detection Notes

Event ID 4689 has no direct ATT&CK technique mapping because process termination alone is not indicator removal or file deletion. ExitStatus 0x0 means successful process termination; pair ProcessId and ProcessName with 4688 on the same host to calculate lifetime and review the process command line, while accounting for process-ID reuse.

Common False Positives

  • Routine process termination is high volume.
  • Short-lived installers and scripts can create bursts.

Related Events

Sample Log

Sanitized event sample
Process Name: C:\Users\Public\tool.exe
Process ID: 0x1092
Exit Status: 0x0

Frequently Asked Questions

What does Windows Event ID 4689 mean?

Event ID 4689 records that a process exited and includes the subject, process identifier, process name, and exit status.

Does Event ID 4689 mean a file was deleted?

No. It records process termination, not file deletion; investigate deletion through file-system, object-access, Sysmon, or EDR telemetry.

How should 4689 be paired with process creation?

Match ProcessId and ProcessName to event 4688 on the same computer while accounting for process-ID reuse, then calculate runtime from the two timestamps.

Sources