name: Windows Event Log Security 4688
id: d195eb26-a81c-45ed-aeb3-25792e8a985a
version: 5
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs the creation of a new process
mitre_components:
    - Process Creation
    - Command Execution
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
separator: EventCode
separator_value: '4688'
configuration: Enabling Windows event log process command line logging via group policy object https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_Windows_event_log_process_command_line_logging_via_group_policy_object
supported_TA:
    - name: Splunk Add-on for Microsoft Windows
      url: https://splunkbase.splunk.com/app/742
      version: 10.0.1
fields:
    - Caller_Domain
    - Caller_User_Name
    - Channel
    - CommandLine
    - Computer
    - Error_Code
    - EventCode
    - EventID
    - EventRecordID
    - Guid
    - Keywords
    - Level
    - Logon_ID
    - MandatoryLabel
    - Name
    - NewProcessId
    - NewProcessName
    - Opcode
    - ParentProcessName
    - ProcessID
    - Process_Command_Line
    - RecordNumber
    - SubjectDomainName
    - SubjectLogonId
    - SubjectUserName
    - SubjectUserSid
    - SystemTime
    - TargetDomainName
    - TargetLogonId
    - TargetUserName
    - TargetUserSid
    - Target_Domain
    - Target_User_Name
    - Task
    - ThreadID
    - TokenElevationType
    - Token_Elevation_Type
    - Token_Elevation_Type_id
    - Version
    - action
    - app
    - dest
    - dvc
    - dvc_nt_host
    - event_id
    - eventtype
    - id
    - name
    - new_process
    - new_process_id
    - new_process_name
    - parent_process
    - parent_process_id
    - parent_process_name
    - parent_process_path
    - process
    - process_command_line_arguments
    - process_command_line_process
    - process_exec
    - process_id
    - process_name
    - process_path
    - product
    - session_id
    - signature
    - signature_id
    - src_nt_domain
    - src_user
    - status
    - subject
    - ta_windows_action
    - tag
    - user
    - user_group
    - vendor
    - vendor_product
output_fields:
    - action
    - dest
    - original_file_name
    - parent_process
    - parent_process_exec
    - parent_process_guid
    - parent_process_id
    - parent_process_name
    - parent_process_path
    - process
    - process_exec
    - process_guid
    - process_hash
    - process_id
    - process_integrity_level
    - process_name
    - process_path
    - user
    - user_id
    - vendor_product
field_mappings:
    - data_model: cim
      data_set: Endpoint.Processes
      mapping:
          NewProcessId: Processes.process_id
          NewProcessName: Processes.process_path
          NewProcessName|endswith: Processes.process_name
          Process_Command_Line: Processes.process
          SubjectUserSid: Processes.user
          ProcessId: Processes.parent_process_id
          ParentProcessName: Processes.parent_process_path
          ParentProcessName|endswith: Processes.parent_process_name
          Computer: Processes.dest
    - data_model: ocsf
      mapping:
          NewProcessId: process.pid
          NewProcessName: process.file.path
          NewProcessName|endswith: process.file.name
          Process_Command_Line: process.cmd_line
          SubjectUserSid: actor.user.name
          ProcessId: actor.process.pid
          ParentProcessName: actor.process.file.path
          ParentProcessName|endswith: actor.process.file.name
          Computer: device.hostname
convert_to_log_source:
    - data_source: Sysmon EventID 1
      mapping:
          NewProcessId: ProcessId
          NewProcessName: Image
          Process_Command_Line: CommandLine
          SubjectUserSid: User
          ProcessId: ParentProcessId
          ParentProcessName: ParentImage
          Computer: Computer
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-04-23T08:48:30.449376800Z'/><EventRecordID>432820</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='276'/><Channel>Security</Channel><Computer>ar-win-1</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>AR-WIN-1$</Data><Data Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='NewProcessId'>0xf84</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0xb2c</Data><Data Name='CommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2</Data><Data Name='TargetUserSid'>NULL SID</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>Mandatory Label\System Mandatory Level</Data></EventData></Event>