liveBook · Manning

Audit process creation policy

As explained in Cyber Threat Hunting

The Audit Process Creation policy is a Windows auditing configuration that controls logging of successful and failed process-creation events.

The Audit Process Creation policy controls whether Windows logs successful and failed process-creation events. Event 4688 records the process name, initiating account, and command-line arguments, supporting monitoring, security analysis, and forensic investigation. section 10.2.5

Configure and verify process-creation auditing with a repeatable workflow:

Enable and verify both audit modes

Run auditpol /set /subcategory:"Process Creation" /success:enable and auditpol /set /subcategory:"Process Creation" /failure:enable, then run auditpol /get /subcategory:"Process Creation" to verify Success and Failure.

How Cyber Threat Hunting covers it

How deep it goes
Explains Event 4688 fields, Group Policy and auditpol configuration, and verification, without extending into event-analysis techniques.
Examples
Uses JSON Event 4688 data and auditpol commands to enable, verify, and inspect process-creation auditing.
What it assumes
Assumes access to Windows auditing controls and an elevated Command Prompt or PowerShell session.
What you can do after
Operate/configure process-creation auditing with auditpol or Windows Group Policy and verify its current setting.
How it connects
Connects Windows Event 4688 with Group Policy, auditpol, endpoint detection and response, and forensic analysis.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.