liveBook · Manning

Command-line logging

As explained in Cyber Threat Hunting

Command-line logging is the recording of command-line text passed to processes in process-creation audit events.

Records the command-line text passed to processes in Windows process-creation audit events. Event 4688 may otherwise contain an empty CommandLine field, reducing visibility during threat hunting. section 10.2.5

Enable and verify the surrounding process-creation audit configuration:

  • Enable Include Command Line in Process Creation Events under Administrative Templates\System\Audit Process Creation. section 10.2.5

Alerting on a deception breadcrumb

After command logging is enabled, search Event 4688 records for api_admin without regard to case. A ten-minute sliding window, email notification, and hourly throttling can turn matching activity into a manageable hunting alert. section 10.2.5

How Cyber Threat Hunting covers it

How deep it goes
Explains the empty-field problem and supplies configuration, verification, and alerting steps, but does not detail event ingestion internals.
Examples
Uses auditpol commands, Event 4688 records, the api_admin search term, and a Humio alert configuration.
What it assumes
Assumes Windows administrative access and introduces process-creation auditing, policy verification, and command-line inclusion.
What you can do after
Operate Windows auditing and configure Event 4688 command-line capture for investigation alerts.
How it connects
Connects process creation auditing with Windows Group Policy, threat hunting, deception, and alerting.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.