thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Event ID 4688

The Windows Security event recorded when a new process is created, optionally including the full command line.

Definition

Process creation auditing must be enabled, and command-line logging requires an additional Group Policy setting. Event 4688 records the new process, parent process and user, making it essential for detecting LOLBins and malicious scripts. Sysmon Event ID 1 provides richer process creation data.

Example

4688 showing cmd.exe spawned by w3wp.exe on an IIS server.

Exam tip

Enable "Include command line in process creation events" for useful 4688 data.

Related terms