Windows Event ID 4688: Process Creation Logging, Command Line Setup, and Detection

Event ID 4688 is the most valuable process creation event in the Windows Security log. When configured correctly it shows you every process that launches on a system — the binary name, the full command line including arguments, the parent process, the user, and the timestamp. When configured incorrectly — which is the default — it shows you the binary name and almost nothing else.

This post covers exactly what 4688 logs, how to enable the command line fields that make it useful, what every field means, and production detection queries that use it in Sentinel, Splunk, and CrowdStrike.

What Event ID 4688 Logs

4688 fires every time a new process is created on the system. By default it captures basic information. With command line auditing enabled — a separate group policy setting — it also captures the full command line, which is what transforms it from a useful event into an indispensable detection data source.

Enabling Command Line Logging

Two settings are required. Both must be configured for command line data to appear in 4688 events.

Setting 1 — Enable process creation auditing

Computer Configuration
  → Windows Settings
    → Security Settings
      → Advanced Audit Policy Configuration
        → Detailed Tracking
          → Audit Process Creation
            → Enable: Success

Setting 2 — Enable command line in process creation events

Computer Configuration
  → Administrative Templates
    → System
      → Audit Process Creation
        → Include command line in process creation events
          → Enable

After both settings are pushed, new 4688 events will include the Process Command Line field. Existing events already in the SIEM are unaffected — they only have what was captured at the time.

Event ID 4688 Field Reference

Detection Queries

Sentinel KQL — suspicious process creation patterns

SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4688
// Suspicious parents — Office apps, browsers
| where ParentProcessName has_any(
    "winword.exe", "excel.exe", "outlook.exe",
    "powerpnt.exe", "chrome.exe", "msedge.exe",
    "firefox.exe", "iexplore.exe"
  )
// Suspicious children — scripting engines, living-off-land binaries
| where NewProcessName has_any(
    "powershell.exe", "pwsh.exe", "cmd.exe",
    "wscript.exe", "cscript.exe", "mshta.exe",
    "rundll32.exe", "regsvr32.exe", "certutil.exe"
  )
| project TimeGenerated, Computer, Account,
    ParentProcessName, NewProcessName,
    ProcessCommandLine, TokenElevationType
| order by TimeGenerated desc

SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4688
| where NewProcessName has_any(
    "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any(
    "-enc", "-encodedcommand",
    "-e ", "-en "
  )
| extend EncodedPart = extract(
    @"(?i)-e(?:nc|n|ncodedcommand)?\s+([A-Za-z0-9+/=]{20,})",
    1, ProcessCommandLine)
| project TimeGenerated, Computer, Account,
    ProcessCommandLine, EncodedPart
| order by TimeGenerated desc

Splunk SPL — process execution from suspicious locations

index=win_* sourcetype="WinEventLog:Security"
EventCode=4688 earliest=-24h
| eval proc_path=lower(coalesce(
    New_Process_Name, NewProcessName))
| where match(proc_path,
    "(\\temp\\|\\tmp\\|\\appdata\\local\\temp\\|
    \\downloads\\|\\users\\public\\|\\programdata\\)")
| eval cmdline=coalesce(
    Process_Command_Line, CommandLine)
| table _time host user proc_path cmdline
| sort 0 -_time

Splunk SPL — elevated process from non-admin user

index=win_* sourcetype="WinEventLog:Security"
EventCode=4688 Token_Elevation_Type="%%1938"
earliest=-24h
| eval proc=lower(coalesce(
    New_Process_Name, NewProcessName))
/* Exclude expected elevated processes */
| where NOT match(proc,
    "(msiexec|trustedinstaller|
    tiworker|svchost|wuauclt)")
| stats count values(proc) as Processes
    by user host
| where count > 5
| sort - count

High-Volume Management: Reducing 4688 Noise

4688 generates a lot of events — in a busy enterprise environment, thousands per minute. The three most effective noise reduction techniques:

• Filter by parent process — most malicious process creation involves unusual parent-child relationships. Filtering to only alert on specific parent processes dramatically reduces volume while preserving signal
• Exclude known-good paths — build and maintain a list of approved binary paths (C:\Windows\System32, C:\Program Files, etc.) and exclude processes launching from those locations unless the parent is also suspicious
• Use process hashes for allowlisting — allowlisting by hash rather than process name prevents attackers from naming their malware "svchost.exe" and bypassing name-based exclusions