name: Windows Event Log Security 4688
id: d195eb26-a81c-45ed-aeb3-25792e8a985a
version: 2
date: '2024-09-26'
author: Patrick Bareiss, Splunk
description: Data source object for Windows Event Log Security 4688
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
separator: EventCode
configuration: Enabling Windows event log process command line logging via group policy
  object https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_Windows_event_log_process_command_line_logging_via_group_policy_object
supported_TA:
- name: Splunk Add-on for Microsoft Windows
  url: https://splunkbase.splunk.com/app/742
  version: 9.0.0
fields:
- Caller_Domain
- Caller_User_Name
- Channel
- CommandLine
- Computer
- Error_Code
- EventCode
- EventID
- EventRecordID
- Guid
- Keywords
- Level
- Logon_ID
- MandatoryLabel
- Name
- NewProcessId
- NewProcessName
- Opcode
- ParentProcessName
- ProcessID
- Process_Command_Line
- RecordNumber
- SubjectDomainName
- SubjectLogonId
- SubjectUserName
- SubjectUserSid
- SystemTime
- TargetDomainName
- TargetLogonId
- TargetUserName
- TargetUserSid
- Target_Domain
- Target_User_Name
- Task
- ThreadID
- TokenElevationType
- Token_Elevation_Type
- Token_Elevation_Type_id
- Version
- action
- app
- dest
- dvc
- dvc_nt_host
- event_id
- eventtype
- id
- name
- new_process
- new_process_id
- new_process_name
- parent_process
- parent_process_id
- parent_process_name
- parent_process_path
- process
- process_command_line_arguments
- process_command_line_process
- process_exec
- process_id
- process_name
- process_path
- product
- session_id
- signature
- signature_id
- src_nt_domain
- src_user
- status
- subject
- ta_windows_action
- tag
- user
- user_group
- vendor
- vendor_product
field_mappings:
- data_model: cim
  data_set: Endpoint.Processes
  mapping:
    NewProcessId: Processes.process_id
    NewProcessName: Processes.process_path
    NewProcessName|endswith: Processes.process_name
    Process_Command_Line: Processes.process
    SubjectUserSid: Processes.user
    ProcessId: Processes.parent_process_id
    ParentProcessName: Processes.parent_process_path
    ParentProcessName|endswith: Processes.parent_process_name
    Computer: Processes.dest
- data_model: ocsf
  mapping:
    NewProcessId: process.pid
    NewProcessName: process.file.path
    NewProcessName|endswith: process.file.name
    Process_Command_Line: process.cmd_line
    SubjectUserSid: actor.user.name
    ProcessId: actor.process.pid
    ParentProcessName: actor.process.file.path
    ParentProcessName|endswith: actor.process.file.name
    Computer: device.hostname
convert_to_log_source:
- data_source: Sysmon EventID 1
  mapping:
    NewProcessId: ProcessId
    NewProcessName: Image
    Process_Command_Line: CommandLine
    SubjectUserSid: User
    ProcessId: ParentProcessId
    ParentProcessName: ParentImage
    Computer: Computer
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
  Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated
  SystemTime='2024-04-23T08:48:30.449376800Z'/><EventRecordID>432820</EventRecordID><Correlation/><Execution
  ProcessID='4' ThreadID='276'/><Channel>Security</Channel><Computer>ar-win-1</Computer><Security/></System><EventData><Data
  Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>AR-WIN-1$</Data><Data
  Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data
  Name='NewProcessId'>0xf84</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe</Data><Data
  Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0xb2c</Data><Data
  Name='CommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"
  --ps2</Data><Data Name='TargetUserSid'>NULL SID</Data><Data Name='TargetUserName'>-</Data><Data
  Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program
  Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>Mandatory
  Label\System Mandatory Level</Data></EventData></Event>