ZEKASTRA

SecurityProcess and object access

4688 · A new process has been created

Generated every time a new process starts. Records the executable path, the creating process, the token elevation type and, if enabled by policy, the command line.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • NewProcessId
  • NewProcessName
  • TokenElevationType
  • ProcessId
  • CommandLine
  • TargetUserSid
  • TargetUserName
  • TargetDomainName
  • TargetLogonId
  • ParentProcessName
  • MandatoryLabel

02How to use it

Build process trees with NewProcessId and ProcessId (the creator), and link them to sessions through SubjectLogonId. Compare with Prefetch, Amcache and 4689 to bound execution.

03Caveats

Requires Audit Process Creation. CommandLine is empty unless "Include command line in process creation events" is enabled. Process IDs are reused, so always pair them with time.

05Sources

  1. Microsoft Learn — 4688(S) A new process has been created checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.