Security event 4688

Location & availability

Windows Security event log; Event ID 4688

Requires audit configuration and access to the log. Command-line capture is a separate setting and may be absent.

Fields to examine

• New process image and process ID.
• Creator process and subject/account fields according to event version.
• Event timestamp and command line when configured.

What it can establish

• Support process creation recorded by the audited host.
• Correlate parent/child processes and an account context.

What it cannot prove

• Identify executable bytes without a separate identity source.
• Treat no event as proof that nothing ran when auditing or retention was incomplete.

Use it in a screenshare

1. Export the relevant Security log without clearing it or enabling a new policy for the historical period.
2. Inspect named event fields and version rather than fixed display-column positions. Distinguish hexadecimal and decimal PID representations.
3. Correlate PID, image and time together; PIDs are reused. Compare the parent and command line with the actual game launch chain.

Worked example

An event shows a launcher creating a helper process. The creation is supported; the purpose of the helper still requires file identity and context. A missing command line is compatible with disabled command-line auditing.

Cross-check the finding

• Sysmon event logs →Link configured process telemetry and subsequent events through ProcessGuid.
• Prefetch →Support execution of an associated executable within the retained history.
• Game and launcher logs →Support the application’s recorded description of a particular instance/session.

Sources

• Microsoft — process creation event 4688 ↗