liveBook · Manning

Security auditing event 4688

As explained in Cyber Threat Hunting

Windows Event 4688 is a Windows audit event record generated when a new process is created, including metadata about the process, initiating account, and command line.

Windows Event 4688 records the creation of a new process, including the process name, initiating user account, and command-line arguments. These details help threat hunters investigate execution context, decoy interactions, and potential compromise. section 10.2.5

Decoy interaction

A decoy may be accessed minutes, hours, or days after deployment. Alerting on the interaction and examining Event 4688 can reveal which process ran, which account initiated it, and what command line was used. section 10.2.5

How Cyber Threat Hunting covers it

How deep it goes
Defines recorded fields and provides auditpol enablement and verification commands, while deferring detailed event interpretation.
Examples
Uses a decoy-interaction scenario, a JSON event record, auditpol commands, and Local Group Policy settings.
What it assumes
Assumes Windows audit-policy access and introduces the purpose and configuration of process-creation auditing.
What you can do after
Operate/configure process-creation auditing with auditpol and verify whether successful or failed events are enabled.
How it connects
Connects process creation auditing with command-line logging, decoys, alerting, EDR, threat hunting, and forensic analysis.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.