win:security 4688
A new process has been created.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Detailed Tracking > Audit Process Creation
- Audit category
- Detailed Tracking
- Audit subcategory
- Audit Process Creation
- Tier, host type
- Minimum
- Techniques
- 106
- Rules depending on it
- Splunk 488, Sigma 1,426, Elastic 172, Microsoft Sentinel 41
Why this tier
CISA/ASD; DISA STIG (server); DISA STIG (workstation); Microsoft audit baseline (dc); Microsoft audit baseline (server); Microsoft audit baseline (workstation); NSA; NSA/ASD web shell guidance
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | CISA/ASD; DISA STIG (workstation); Microsoft audit baseline (workstation); NSA |
| Windows member server | Minimum | CISA/ASD; DISA STIG (server); Microsoft audit baseline (server); NSA |
| Windows domain controller | Minimum | CISA/ASD; DISA STIG (server); Microsoft audit baseline (dc); Microsoft audit baseline (server); NSA |
| Windows web server (IIS), internet-facing | Minimum | CISA/ASD; DISA STIG (server); Microsoft audit baseline (server); NSA; NSA/ASD web shell guidance |
Techniques it helps detect
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1005 Data from Local System
- T1006 Direct Volume Access
- T1007 System Service Discovery
- T1020 Automated Exfiltration
- T1027 Obfuscated Files or Information
- T1027.001 Binary Padding
- T1027.010 Command Obfuscation
- T1027.013 Encrypted/Encoded File
- T1027.018 Invisible Unicode
- T1036.005 Match Legitimate Resource Name or Location
- T1037 Boot or Logon Initialization Scripts
- T1037.001 Logon Script (Windows)
- T1037.003 Network Logon Script
- T1040 Network Sniffing
- T1048 Exfiltration Over Alternative Protocol
- T1055.011 Extra Window Memory Injection
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1069 Permission Groups Discovery
- T1069.001 Local Groups
- T1069.002 Domain Groups
- T1072 Software Deployment Tools
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1098.002 Additional Email Delegate Permissions
- T1114.003 Email Forwarding Rule
- T1120 Peripheral Device Discovery
- T1123 Audio Capture
- T1124 System Time Discovery
- T1127 Trusted Developer Utilities Proxy Execution
- T1127.001 MSBuild
- T1127.002 ClickOnce
- T1127.003 JamPlus
- T1129 Shared Modules
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1134.001 Token Impersonation/Theft
- T1134.002 Create Process with Token
- T1134.003 Make and Impersonate Token
- T1134.004 Parent PID Spoofing
- T1135 Network Share Discovery
- T1176 Software Extensions
- T1176.001 Browser Extensions
- T1176.002 IDE Extensions
- T1189 Drive-by Compromise
- T1197 BITS Jobs
- T1204 User Execution
- T1204.001 Malicious Link
- T1204.004 Malicious Copy and Paste
- T1211 Exploitation for Stealth
- T1213.006 Databases
- T1218.005 Mshta
- T1218.007 Msiexec
- T1218.008 Odbcconf
- T1218.009 Regsvcs/Regasm
- T1218.010 Regsvr32
- T1218.013 Mavinject
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1480 Execution Guardrails
- T1495 Firmware Corruption
- T1498.001 Direct Network Flood
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1518.002 Backup Software Discovery
- T1539 Steal Web Session Cookie
- T1542 Pre-OS Boot
- T1542.001 System Firmware
- T1546.002 Screensaver
- T1547 Boot or Logon Autostart Execution
- T1547.014 Active Setup
- T1548 Abuse Elevation Control Mechanism
- T1548.002 Bypass User Account Control
- T1552 Unsecured Credentials
- T1553.002 Code Signing
- T1553.006 Code Signing Policy Modification
- T1554 Compromise Host Software Binary
- T1555.004 Windows Credential Manager
- T1555.005 Password Managers
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1560.002 Archive via Library
- T1560.003 Archive via Custom Method
- T1564.010 Process Argument Spoofing
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1567 Exfiltration Over Web Service
- T1568.002 Domain Generation Algorithms
- T1574.014 AppDomainManager
- T1611 Escape to Host
- T1614 System Location Discovery
- T1652 Device Driver Discovery
- T1653 Power Settings
- T1654 Log Enumeration
- T1659 Content Injection
- T1668 Exclusive Control
- T1673 Virtual Machine Discovery
- T1674 Input Injection
- T1679 Selective Exclusion
- T1686 Disable or Modify System Firewall
- T1686.003 Windows Host Firewall
- T1687 Exploitation for Defense Impairment
- T1688 Safe Mode Boot
Rules that depend on it
400 of 2,127 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.
Sigma 187 listed of 1,426
- 7Zip Compressing Dump Files by Nasreddine Bencherchali (Nextron Systems)
- AADInternals PowerShell Cmdlets Execution - ProccessCreation by Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
- APT27 - Emissary Panda Activity by Florian Roth (Nextron Systems)
- APT29 2018 Phishing Campaign CommandLine Indicators by Florian Roth (Nextron Systems), @41thexplorer
- APT31 Judgement Panda Activity by Florian Roth (Nextron Systems)
- AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl by Julia Fomina, oscd.community
- Abuse of Service Permissions to Hide Services Via Set-Service by Nasreddine Bencherchali (Nextron Systems)
- Abused Debug Privilege by Arbitrary Parent Processes by Semanur Guneysu @semanurtg, oscd.community
- Abusing Print Executable by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative
- Active Directory Database Snapshot Via ADExplorer by Nasreddine Bencherchali (Nextron Systems)
- Active Directory Structure Export Via Csvde.EXE by Nasreddine Bencherchali (Nextron Systems)
- Active Directory Structure Export Via Ldifde.EXE by Nasreddine Bencherchali (Nextron Systems)
- Add Insecure Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
- Add New Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
- Add Potential Suspicious New Download Source To Winget by Nasreddine Bencherchali (Nextron Systems)
- Add SafeBoot Keys Via Reg Utility by Nasreddine Bencherchali (Nextron Systems)
- Add Windows Capability Via PowerShell Cmdlet by Nasreddine Bencherchali (Nextron Systems)
- AddinUtil.EXE Execution From Uncommon Directory by Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
- Adwind RAT / JRAT by Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
- AgentExecutor PowerShell Execution by Nasreddine Bencherchali (Nextron Systems), memory-shards
- All Backups Deleted Via Wbadmin.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)
- Allow Service Access Using Security Descriptor Tampering Via Sc.EXE by Nasreddine Bencherchali (Nextron Systems)
- Always Install Elevated MSI Spawned Cmd And Powershell by Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
- Always Install Elevated Windows Installer by Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
- Application Removed Via Wmic.EXE by frack113
- Application Termination Attempt via Wmic.EXE by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary Binary Execution Using GUP Utility by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary Command Execution Using WSL by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
- Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE by Beyu Denis, oscd.community
- Arbitrary File Download Via ConfigSecurityPolicy.EXE by frack113
- Arbitrary File Download Via GfxDownloadWrapper.EXE by Victor Sergeev, oscd.community
- Arbitrary File Download Via IMEWDBLD.EXE by Swachchhanda Shrawan Poudel
- Arbitrary File Download Via MSEDGE_PROXY.EXE by Swachchhanda Shrawan Poudel
- Arbitrary File Download Via MSOHTMED.EXE by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary File Download Via MSPUB.EXE by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary File Download Via PresentationHost.EXE by Nasreddine Bencherchali (Nextron Systems)
- Arbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
- Arbitrary MSI Download Via Devinit.EXE by Florian Roth (Nextron Systems)
- Arbitrary Shell Command Execution Via Settingcontent-Ms by Sreeman
- AspNetCompiler Execution by frack113
- Assembly Loading Via CL_LoadAssembly.ps1 by frack113, Nasreddine Bencherchali (Nextron Systems)
- Attempts of Kerberos Coercion Via DNS SPN Spoofing by Swachchhanda Shrawan Poudel (Nextron Systems)
- Audio Capture via PowerShell by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)
- Audio Capture via SoundRecorder by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
- Audit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)
- Audit Policy Tampering Via NT Resource Kit Auditpol by Nasreddine Bencherchali (Nextron Systems)
- Automated Collection Command Prompt by frack113
- Axios NPM Compromise Indicators - Windows by Swachchhanda Shrawan Poudel (Nextron Systems)
- Bad Opsec Defaults Sacrificial Processes With Improper Arguments by Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
- Base64 Encoded PowerShell Command Detected by Florian Roth (Nextron Systems)
- Base64 MZ Header In CommandLine by Nasreddine Bencherchali (Nextron Systems)
- Binary Proxy Execution Via Dotnet-Trace.EXE by Jimmy Bayne (@bohops)
- BitLockerTogo.EXE Execution by Josh Nickels, mttaggart
- Blue Mockingbird by Trent Liffick (@tliffick)
- Boot Configuration Tampering Via Bcdedit.EXE by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
- Browser Execution In Headless Mode by Nasreddine Bencherchali (Nextron Systems)
- Browser Started with Remote Debugging by pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- Bypass UAC via CMSTP by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
- Bypass UAC via Fodhelper.exe by E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community
- Bypass UAC via WSReset.exe by E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth
- C# IL Code Compilation Via Ilasm.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)
- CMD Shell Output Redirect by frack113
- CMSTP Execution Process Creation by Nik Seetharaman
- CMSTP UAC Bypass via COM Object Access by Nik Seetharaman, Christian Burkard (Nextron Systems)
- COLDSTEEL RAT Anonymous User Process Execution by Nasreddine Bencherchali (Nextron Systems)
- COLDSTEEL RAT Cleanup Command Execution by Nasreddine Bencherchali (Nextron Systems)
- COLDSTEEL RAT Service Persistence Execution by X__Junior (Nextron Systems)
- COM Object Execution via Xwizard.EXE by Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
- CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) by Andreas Braathen (mnemonic.io)
- CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process by Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
- CVE-2024-50623 Exploitation Attempt - Cleo by Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson
- Cab File Extraction Via Wusa.EXE by Nasreddine Bencherchali (Nextron Systems)
- Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths by Nasreddine Bencherchali (Nextron Systems)
- Capture Credentials with Rpcping.exe by Julia Fomina, oscd.community
- Certificate Exported Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
- Certificate Exported Via PowerShell by Nasreddine Bencherchali (Nextron Systems)
- Change Default File Association To Executable Via Assoc by Nasreddine Bencherchali (Nextron Systems)
- Change Default File Association Via Assoc by Timur Zinniatullin, oscd.community
- Change PowerShell Policies to an Insecure Level by frack113
- Changing Existing Service ImagePath Value Via Reg.EXE by frack113
- Chopper Webshell Process Pattern by Florian Roth (Nextron Systems), MSTI (query)
- ChromeLoader Malware Execution by @kostastsale
- Chromium Browser Headless Execution To Mockbin Like Site by X__Junior (Nextron Systems)
- Chromium Browser Instance Executed With Custom Extension by Aedan Russell, frack113, X__Junior (Nextron Systems)
- ClickOnce Deployment Execution - Dfsvc.EXE Child Process by Nasreddine Bencherchali (Nextron Systems)
- Cloudflared Portable Execution by Nasreddine Bencherchali (Nextron Systems)
- Cloudflared Quick Tunnel Execution by Sajid Nawaz Khan
- Cloudflared Tunnel Connections Cleanup by Nasreddine Bencherchali (Nextron Systems)
- Cloudflared Tunnel Execution by Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
- Cmd Launched with Hidden Start Flags to Suspicious Targets by Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)
- Cmd.EXE Missing Space Characters Execution Anomaly by Florian Roth (Nextron Systems)
- CobaltStrike Load by Rundll32 by Wojciech Lesicki
- Code Execution via Pcwutl.dll by Julia Fomina, oscd.community
- CodePage Modification Via MODE.COM by Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk
- CodePage Modification Via MODE.COM To Russian Language by Joseliyo Sanchez, @Joseliyo_Jstnk
- Command Line Execution with Suspicious URL and AppData Strings by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
- Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791) by X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
- Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788) by Swachchhanda Shrawan Poudel (Nextron Systems)
- Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790) by Swachchhanda Shrawan Poudel (Nextron Systems)
- Compress Data and Lock With Password for Exfiltration With 7-ZIP by frack113
- Compress Data and Lock With Password for Exfiltration With WINZIP by frack113
- Compressed File Creation Via Tar.EXE by Nasreddine Bencherchali (Nextron Systems), AdmU3
- Compressed File Extraction Via Tar.EXE by AdmU3
- Computer Discovery And Export Via Get-ADComputer Cmdlet by Nasreddine Bencherchali (Nextron Systems)
- Computer Password Change Via Ksetup.EXE by Nasreddine Bencherchali (Nextron Systems)
- Computer System Reconnaissance Via Wmic.EXE by Nasreddine Bencherchali (Nextron Systems)
- Conhost Spawned By Uncommon Parent Process by Tim Rauch, Elastic (idea)
- Conhost.exe CommandLine Path Traversal by Nasreddine Bencherchali (Nextron Systems)
- Console CodePage Lookup Via CHCP by _pete_0, TheDFIRReport
- Conti NTDS Exfiltration Command by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
- Conti Volume Shadow Listing by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
- Control Panel Items by Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
- ConvertTo-SecureString Cmdlet Usage Via CommandLine by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
- Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE by Nasreddine Bencherchali (Nextron Systems)
- Copy From Or To Admin Share Or Sysvol Folder by Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
- Copy From VolumeShadowCopy Via Cmd.EXE by Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
- Copying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
- CreateDump Process Dump by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- Csc.EXE Execution Form Potentially Suspicious Parent by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
- Cscript/Wscript Potentially Suspicious Child Process by Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86')
- Cscript/Wscript Uncommon Script Extension Execution by Nasreddine Bencherchali (Nextron Systems)
- Curl Download And Execute Combination by Sreeman, Nasreddine Bencherchali (Nextron Systems)
- Curl File Upload To File Sharing Websites by Swachchhanda Shrawan Poudel (Nextron Systems)
- Curl Web Request With Potential Custom User-Agent by Nasreddine Bencherchali (Nextron Systems)
- Curl.EXE Execution by Florian Roth (Nextron Systems)
- Curl.EXE Execution With Custom UserAgent by frack113
- DLL Call by Ordinal Via Rundll32.EXE by Florian Roth (Nextron Systems)
- DLL Execution Via Register-cimprovider.exe by Ivan Dyachkov, Yulia Fomina, oscd.community
- DLL Execution via Rasautou.exe by Julia Fomina, oscd.community
- DLL Loaded via CertOC.EXE by Austin Songer @austinsonger
- DLL Sideloading by VMware Xfer Utility by Nasreddine Bencherchali (Nextron Systems)
- DNS Exfiltration and Tunneling Tools Execution by Daniil Yugoslavskiy, oscd.community
- DNS RCE CVE-2020-1350 by Florian Roth (Nextron Systems)
- DSInternals Suspicious PowerShell Cmdlets by Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri
- DarkGate - Autoit3.EXE Execution Parameters by Micah Babinski
- DarkGate - User Created Via Net.EXE by X__Junior (Nextron Systems)
- DarkSide Ransomware Pattern by Florian Roth (Nextron Systems)
- Data Copied To Clipboard Via Clip.EXE by frack113
- Data Export From MSSQL Table Via BCP.EXE by Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems)
- Defrag Deactivation by Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
- Delete All Scheduled Tasks by Nasreddine Bencherchali (Nextron Systems)
- Delete Important Scheduled Task by Nasreddine Bencherchali (Nextron Systems)
- Deleted Data Overwritten Via Cipher.EXE by frack113
- Deletion of Volume Shadow Copies via WMI with PowerShell by Tim Rauch, Elastic (idea)
- Deny Service Access Using Security Descriptor Tampering Via Sc.EXE by Jonhnathan Ribeiro, oscd.community
- Detected Windows Software Discovery by Nikita Nazarov, oscd.community
- Detection of PowerShell Execution via Sqlps.exe by Agro (@agro_sev) oscd.community
- Devcon Execution Disabling VMware VMCI Device by Matt Anderson, Dray Agha, Anna Pham (Huntress)
- DeviceCredentialDeployment Execution by Nasreddine Bencherchali (Nextron Systems)
- Devtoolslauncher.exe Executes Specified Binary by Beyu Denis, oscd.community (rule), @_felamos (idea)
- Diamond Sleet APT Process Activity Indicators by Nasreddine Bencherchali (Nextron Systems)
- DirLister Execution by frack113
- Direct Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)
- Directory Removal Via Rmdir by frack113
- Disable Important Scheduled Task by frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior
- Disable Windows Defender AV Security Monitoring by ok @securonix invrep-de, oscd.community, frack113
- Disable Windows IIS HTTP Logging by frack113
- Disabled IE Security Features by Florian Roth (Nextron Systems)
- Disabled Volume Snapshots by Florian Roth (Nextron Systems)
- Disabling Windows Defender WMI Autologger Session via Reg.exe by Matt Anderson (Huntress)
- Discovery of a System Time by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
- Diskshadow Child Process Spawned by Harjot Singh @cyb3rjy0t
- Diskshadow Script Mode - Execution From Potential Suspicious Location by Nasreddine Bencherchali (Nextron Systems)
- Diskshadow Script Mode - Uncommon Script Extension Execution by Nasreddine Bencherchali (Nextron Systems)
- Diskshadow Script Mode Execution by Ivan Dyachkov, oscd.community
- Dism Remove Online Package by frack113
- DllUnregisterServer Function Call Via Msiexec.EXE by frack113
- Dllhost.EXE Execution Anomaly by Nasreddine Bencherchali (Nextron Systems)
- Domain Trust Discovery Via Dsquery by E.M. Anhaus, Tony Lambert, oscd.community, omkar72
- Driver/DLL Installation Via Odbcconf.EXE by Nasreddine Bencherchali (Nextron Systems)
- DriverQuery.EXE Execution by Nasreddine Bencherchali (Nextron Systems)
- Droppers Exploiting CVE-2017-11882 by Florian Roth (Nextron Systems)
- Dropping Of Password Filter DLL by Sreeman
- DumpMinitool Execution by Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
- DumpStack.log Defender Evasion by Florian Roth (Nextron Systems)
- Dumping Process via Sqldumper.exe by Kirill Kiryanov, oscd.community
- Dumping of Sensitive Hives Via Reg.EXE by Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113
- Dynamic .NET Compilation Via Csc.EXE by Florian Roth (Nextron Systems), X__Junior (Nextron Systems)
- Dynamic .NET Compilation Via Csc.EXE - Hunting by Nasreddine Bencherchali (Nextron Systems)
- ETW Logging Tamper In .NET Processes Via CommandLine by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- ETW Trace Evasion Activity by @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
- Elevated System Shell Spawned by Nasreddine Bencherchali (Nextron Systems), frack113
- Elevated System Shell Spawned From Uncommon Parent Location by frack113, Tim Shelton (update fp)
- Elise Backdoor Activity by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- Email Exifiltration Via Powershell by Nasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea)
- Emotet Loader Execution Via .LNK File by @kostastsale
- Enable LM Hash Storage - ProcCreation by Nasreddine Bencherchali (Nextron Systems)
Elastic 172
- Accessing Outlook Data Filesinferred
- Active Directory Discovery using AdExplorerinferred
- AdFind Command Activityinferred
- Adding Hidden File Attribute via Attribinferred
- At.exe Command Lateral Movementinferred
- Attempt to Establish VScode Remote Tunnelinferred
- Attempt to Install or Run Kali Linux via WSLinferred
- Attempted Private Key Accessinferred
- Backup Deletion with Wbadmininferred
- Binary Content Copy via Cmd.exeinferred
- Bitsadmin Activityinferred
- Browser Process Spawned from an Unusual Parentinferred
- Bypass UAC via Event Viewerinferred
- Clearing Windows Console Historyinferred
- Clearing Windows Event Logsinferred
- Code Signing Policy Modification Through Built-in toolsinferred
- Command Execution via ForFilesinferred
- Command Execution via SolarWinds Processinferred
- Command Obfuscation via Unicode Modifier Lettersinferred
- Command and Scripting Interpreter via Windows Scriptsinferred
- Control Panel Process with Unusual Argumentsinferred
- Credential Access via TruffleHog Executioninferred
- Credential Acquisition via Registry Hive Dumpinginferred
- Curl or Wget Spawned via Node.jsinferred
- Data Encrypted via OpenSSL Utilityinferred
- Delete Volume USN Journal with Fsutilinferred
- Disable Windows Event and Security Logs Using Built-in Toolsinferred
- Disable Windows Firewall Rules via Netshinferred
- Disabling Windows Defender Security Settings via PowerShellinferred
- Enable Host Network Discovery via Netshinferred
- Enumerating Domain Trusts via DSQUERY.EXEinferred
- Enumerating Domain Trusts via NLTEST.EXEinferred
- Enumeration Command Spawned via WMIPrvSEinferred
- Enumeration of Administrator Accountsinferred
- Execution from Unusual Directory - Command Lineinferred
- Execution of COM object via Xwizardinferred
- Execution via GitHub Actions Runnerinferred
- Execution via MSSQL xp_cmdshell Stored Procedureinferred
- Execution via TSClient Mountpointinferred
- Execution via Windows Command Debugging Utilityinferred
- Execution via Windows Subsystem for Linuxinferred
- Exporting Exchange Mailbox via PowerShellinferred
- First Time Seen Remote Monitoring and Management Toolinferred
- Group Policy Discovery via Microsoft GPResult Utilityinferred
- High Number of Process and/or Service Terminationsinferred
- IIS HTTP Logging Disabledinferred
- ImageLoad via Windows Update Auto Update Clientinferred
- Indirect Command Execution via Forfiles/Pcaluainferred
- InstallUtil Activityinferred
- Kubernetes Direct API Request via Curl or Wgetinferred
- Microsoft Build Engine Started an Unusual Processinferred
- Microsoft Build Engine Started by a System Processinferred
- Microsoft Build Engine Started by an Office Applicationinferred
- Microsoft Exchange Server UM Spawning Suspicious Processesinferred
- Microsoft IIS Connection Strings Decryptioninferred
- Microsoft IIS Service Account Password Dumpedinferred
- Microsoft Management Console File from Unusual Pathinferred
- Modification of Boot Configurationinferred
- Mofcomp Activityinferred
- Mounting Hidden or WebDav Remote Sharesinferred
- Multi-Cloud CLI Token and Credential Access Commandsinferred
- Multiple Remote Management Tool Vendors on Same Hostinferred
- NTDS Dump via Wbadmininferred
- NTDS or SAM Database File Copiedinferred
- NetSupport Manager Execution from an Unusual Pathinferred
- New ActiveSyncAllowedDeviceID Added via PowerShellinferred
- Newly Seen Commonly Abused Network Scannerinferred
- Peripheral Device Discoveryinferred
- Persistence via TelemetryController Scheduled Task Hijackinferred
- Persistence via WMI Event Subscriptioninferred
- Potential Application Shimming via Sdbinstinferred
- Potential Cookies Theft via Browser Debugginginferred
- Potential Credential Access via Windows Utilitiesinferred
- Potential DNS Tunneling via NsLookupinferred
- Potential Data Exfiltration Through Curlinferred
- Potential Data Exfiltration via Rcloneinferred
- Potential Defense Evasion via CMSTP.exeinferred
- Potential Entra ID PRT Extraction via BrowserCoreinferred
- Potential Evasion via Filter Managerinferred
- Potential Execution via FileFix Phishing Attackinferred
- Potential Exploitation of an Unquoted Service Path Vulnerabilityinferred
- Potential Fake CAPTCHA Phishing Attackinferred
- Potential File Download via a Headless Browserinferred
- Potential File Transfer via Certreqinferred
- Potential File Transfer via Curl for Windowsinferred
- Potential Foxmail Exploitationinferred
- Potential LSASS Clone Creation via PssCaptureSnapShot
- Potential Local NTLM Relay via HTTPinferred
- Potential Masquerading as Svchostinferred
- Potential Protocol Tunneling via Cloudflaredinferred
- Potential Protocol Tunneling via Yuzeinferred
- Potential Remote Desktop Tunneling Detectedinferred
- Potential Remote Install via MsiExecinferred
- Potential SSH Reverse Port Forwardinginferred
- Potential Secret Scanning via Gitleaksinferred
- Potential Traffic Tunneling using QEMUinferred
- Potential Tunneling via Tailscaledinferred
- Potential Veeam Credential Access Commandinferred
- Potential WSUS Abuse for Lateral Movementinferred
- Privilege Escalation via Named Pipe Impersonationinferred
- Process Activity via Compiled HTML Fileinferred
- Process Creation via Secondary Logoninferred
- Process Discovery Using Built-in Toolsinferred
- Process Execution from an Unusual Directoryinferred
- Program Files Directory Masqueradinginferred
- Proxy Execution via Console Window Hostinferred
- Proxy Execution via Windows OpenSSHinferred
- Rare Connection to WebDAV Targetinferred
- Remote Desktop Enabled in Windows Firewall by Netshinferred
- Remote Desktop File Opened from Suspicious Pathinferred
- Remote File Copy to a Hidden Shareinferred
- Remote File Download via Desktopimgdownldr Utilityinferred
- Remote File Download via MpCmdRuninferred
- Remote GitHub Actions Runner Registrationinferred
- Remote Management Access Launch After MSI Installinferred
- ScreenConnect Server Spawning Suspicious Processesinferred
- Script Execution via Microsoft HTML Applicationinferred
- Searching for Saved Credentials via VaultCmdinferred
- Security Software Discovery using WMICinferred
- Service Control Spawned via Script Interpreterinferred
- Service Path Modification via sc.exeinferred
- Signed Proxy Execution via MS Work Foldersinferred
- Suspicious .NET Code Compilationinferred
- Suspicious CertUtil Commandsinferred
- Suspicious Child Process of PaperCut Server Componentinferred
- Suspicious Cmd Execution via WMIinferred
- Suspicious Endpoint Security Parent Processinferred
- Suspicious Execution from INET Cacheinferred
- Suspicious Execution from a WebDav Shareinferred
- Suspicious Execution with NodeJSinferred
- Suspicious File Downloaded from Google Driveinferred
- Suspicious Instance Metadata Service (IMDS) API Command Line Executioninferred
- Suspicious JavaScript Execution via Denoinferred
- Suspicious JetBrains TeamCity Child Processinferred
- Suspicious MS Office Child Processinferred
- Suspicious MS Outlook Child Processinferred
- Suspicious Microsoft HTML Application Child Processinferred
- Suspicious PDF Reader Child Processinferred
- Suspicious ScreenConnect Client Child Processinferred
- Suspicious Shell Execution via Velociraptorinferred
- Suspicious Troubleshooting Pack Cabinet Executioninferred
- Suspicious Windows Command Shell Argumentsinferred
- Suspicious Windows Powershell Argumentsinferred
- Suspicious Zoom Child Processinferred
- Svchost spawning Cmdinferred
- Symbolic Link to Shadow Copy Createdinferred
- System File Ownership Changeinferred
- System Information Discovery via Windows Command Shellinferred
- System Service Discovery through built-in Windows Utilitiesinferred
- System Shells via Servicesinferred
- System Time Discoveryinferred
- UAC Bypass Attempt via Windows Directory Masqueradinginferred
- UAC Bypass via DiskCleanup Scheduled Task Hijackinferred
- Unusual Child Process from a System Virtual Processinferred
- Unusual Child Process of dns.exeinferred
- Unusual Parent-Child Relationshipinferred
- Unusual Print Spooler Child Processinferred
- Unusual Process Execution on WBEM Pathinferred
- User Account Creationinferred
- Volume Shadow Copy Deleted or Resized via VssAdmininferred
- Volume Shadow Copy Deletion via PowerShellinferred
- Volume Shadow Copy Deletion via WMICinferred
- WMI WBEMTEST Utility Executioninferred
- WMIC Remote Commandinferred
- Web Shell Detection: Script Process Child of Common Web Processesinferred
- Whoami Process Activityinferred
- Windows Defender Exclusions Added via PowerShellinferred
- Windows Firewall Disabled via PowerShellinferred
- Windows Script Execution from Archiveinferred
- Windows Subsystem for Linux Enabled via Dism Utilityinferred
- Windows System Information Discoveryinferred
- Wireless Credential Dumping using Netsh Commandinferred
Microsoft Sentinel 41
- Base64 encoded Windows process command-lines
- Base64 encoded Windows process command-lines (Normalized Process Events)inferred
- Caramel Tsunami Actor IOC - July 2021
- CertUtil Used for File Download (Living off the Land)
- DEV-0270 New User Creation
- Dev-0270 Malicious Powershell usage
- Dev-0270 Registry IOC - September 2022
- Dev-0270 WMIC Discovery
- Email access via active sync
- Gain Code Execution on ADFS Server via Remote WMI Execution
- Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task
- Identify Mango Sandstorm powershell commands
- Identify SysAid Server web shell creation
- Malware in the recycle bin
- Malware in the recycle bin (Normalized Process Events)inferred
- Midnight Blizzard - Script payload stored in Registry
- Midnight Blizzard - suspicious rundll32.exe execution of vbscript
- Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)inferred
- NRT Base64 Encoded Windows Process Command-lines
- NRT Process executed from binary hidden in Base64 encoded file
- Network endpoint to host executable correlation
- New EXE deployed via Default Domain or Default Domain Controller Policies
- Potential Build Process Compromise
- Potential Fodhelper UAC Bypass
- Potential Fodhelper UAC Bypass (ASIM Version)inferred
- Potential re-named sdelete usage
- Potential re-named sdelete usage (ASIM Version)inferred
- PowerShell Encoded Command Execution (Living off the Land)
- Powershell Empire Cmdlets Executed in Command Line
- Probable AdFind Recon Tool Usage (Normalized Process Events)inferred
- Process Execution Frequency Anomaly
- Process executed from binary hidden in Base64 encoded file
- SUNBURST suspicious SolarWinds child processes (Normalized Process Events)inferred
- Sdelete deployed via GPO and run recursively
- Sdelete deployed via GPO and run recursively (ASIM Version)inferred
- Security Service Registry ACL Modification
- Silk Typhoon New UM Service Child Process
- Unusual identity creation using exchange powershell
- WMI Spawning Suspicious Child Process (Living off the Land)
- Windows Binaries Executed from Non-Default Directory
- Zinc Actor IOCs files - October 2022
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Indicators of compromiseAppendix B item 5(7) | Supports an activity | our analysis: process and command-line indicators |
| ASD ACSC / CISA et al.: Process creation and command-line auditingBest Practices for Event Logging and Threat Detection (Aug 2024) | Names this event | quoted: process creation events and command-line auditing (4688 with the command line policy on) |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000050 (workstation): Audit Process Creation Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000585 (workstation): Audit Process Creation Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-CC-000066 (workstation): Include command line in process creation events Policy |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000140 (server): Audit Process Creation Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-CC-000090 (server): Include command line in process creation events Policy |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000050 (workstation): Audit Process Creation Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000585 (workstation): Audit Process Creation Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-CC-000066 (workstation): Include command line in process creation events Policy |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000140 (server): Audit Process Creation Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-CC-000090 (server): Include command line in process creation events Policy |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000140 (server): Audit Process Creation Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-CC-000090 (server): Include command line in process creation events Policy |
| NSA and ASD: Web shell detection guidanceDetect and Prevent Web Shell Malware (CSI PP-20-0901, April 2020) | Names this event | our analysis: 4688 with command line is the Security-log equivalent of the Sysmon 1 recommendation |
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | Application Whitelisting: Process Created |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: A new process has been created. |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | ProcessRollup2 | Full | pySigma-backend-crowdstrike: process_creation; Sigma taxonomy names Security 4688 as the alternate for process_creation; ProcessRollup2 carries CommandLine |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | SyntheticProcessRollup2 | Full | pySigma-backend-crowdstrike: process_creation; Sigma taxonomy names Security 4688 as the alternate for process_creation; ProcessRollup2 carries CommandLine |
| Microsoft Defender for Endpoint device tables | DeviceProcessEvents | Full | pySigma-backend-kusto: process_creation -> DeviceProcessEvents; ProcessCommandLine present |
| Elastic Defend endpoint events | process | Full | Elastic Defend process dataset carries process.command_line |