Windows Process Tracking events
After discussing the Windows processes, their relation, and the legitimate attributes of the most common standard Windows processes, you may now be wondering whether we can track the process creation activities using Microsoft Windows events. The answer is yes. Microsoft allows you to track every process creation and termination activity by recording two Event IDs in the security event log file:
- Event ID 4688 records every process creation activity
- Event ID 4689 records every process exit activity
As we will see in the next section, when investigating suspicious Windows process behavior, you will determine that those process tracking events are crucial to any incident responder, SOC analyst, and threat hunter to detect and investigate such anomalies.
Event ID 4688, named A new process has been created., is recorded in the security log file and contains very useful information about the username, process name, process path, and parent...
