relationship_id: REL-2022-0131
name: Process executed Command
contributors:
- Jose Rodriguez @Cyb3rPandaH
- Roberto Rodriguez @Cyb3rWard0g
- Olaf Hartong @olafhartong
attack:
  data_source: command
  data_component: command execution
behavior:
  source: process
  relationship: executed
  target: command
security_events:
- event_id: '4688'
  name: A new process has been created.
  platform: windows
  audit_category: Detailed Tracking
  audit_sub_category: Process Creation
  channel: Security
  log_source: Microsoft-Windows-Security-Auditing
  event_version:
  - '2'
- event_id: '1'
  name: Process Creation.
  platform: windows
  audit_category: ProcessCreate
  channel: Microsoft-Windows-Sysmon/Operational
  log_source: Microsoft-Windows-Sysmon
  event_version:
  - '4.32'
- event_id: '1'
  name: Process Creation.
  platform: linux
  audit_category: ProcessCreate
  log_source: sysmon
  event_version:
  - '4.81'
- event_id: '4103'
  name: Module logging.
  platform: windows
  channel: Microsoft-Windows-PowerShell/Operational
  log_source: Microsoft-Windows-PowerShell
  event_version:
  - '0'
- event_id: DeviceProcessEvents
  name: DeviceProcessEvents
  platform: windows
  log_source: Microsoft Defender for Endpoint
  filter_in:
  - ActionType: ProcessCreated
  event_version:
  - '0'
  - '1'
references:
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation
- 
notes: null