thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Process Creation Logging

Recording every new process with its command line, parent and user to support detection and investigation.

Definition

Process creation data is among the most valuable telemetry for detecting malicious activity, including LOLBin abuse and script execution. Sources include Windows Event ID 4688, Sysmon Event ID 1, Linux auditd execve records and EDR telemetry.

Example

Detecting excel.exe spawning powershell.exe -enc via process creation logs.

Exam tip

Parent-child process anomalies are a core detection concept.

Related terms