Processes List of processes identified through event id 4688 and listed in the www.eventid.net list of processes that may indicate suspicious activity. To generate event id 4688, a system requires the audit of process creation. See the documentation for more details.

Select time range -24h@h now Computer All * ( ) ComputerName=" " OR `event_sources` (EventCode=4688) | stats count by ComputerName $interval.earliest$ $interval.latest$ ComputerName ComputerName Process Id All * ( ) New_Process_ID=" " OR `event_sources` (EventCode=4688) | stats count by New_Process_ID $interval.earliest$ $interval.latest$ New_Process_ID New_Process_ID Creator Process Id All * ( ) Creator_Process_ID=" " OR `event_sources` (EventCode=4688) | stats count by Creator_Process_ID $interval.earliest$ $interval.latest$ Creator_Process_ID Creator_Process_ID Keyword: * Hide computer accounts related events Yes No Account_Name != "*$*" Account_Name != "*$*" Filter out cmd.exe and powershell.exe Yes No New_Process_Name = "*" New_Process_Name = "*"

`event_sources` AND $Computer$ AND $keyword$ $nocomputer$ $creator$ $process_id$ $nocmdpowershell$ (EventCode=4688) | lookup processlookup full_path_process as New_Process_Name OUTPUT process | lookup interesting_process_lookup process OUTPUT Category,Process_Details | search Category="*" | table _time, host, Account_Name, Process_Command_Line, process,Category,Process_Details, New_Process_ID, Creator_Process_ID | rename host as Server,process as Process,Process_Details as "Interesting Process Details" $interval.earliest$ $interval.latest$ 1 20nonecellfalseprogressbarfalsefalsetrue `event_sources` (EventCode=4688) AND $Computer$ AND $keyword$ $nocomputer$ $creator$ $process_id$ $nocmdpowershell$ | head 100 | table _time, host,Account_Name, New_Process_Name,Process_Command_Line, New_Process_ID, Creator_Process_ID $interval.earliest$ $interval.latest$ 1 20nonecellfalseprogressbarfalsefalsetrue `event_sources` (EventCode=4688) AND $Computer$ AND $keyword$ $nocomputer$ $creator$ $process_id$ $nocmdpowershell$ | stats count by host, New_Process_Name | table host, New_Process_Name,count | sort -count | rename count as Count $interval.earliest$ $interval.latest$ 1 20nonecellfalsefalsefalsetrue `event_sources` (EventCode=4688) AND $Computer$ AND $keyword$ $nocomputer$ $creator$ $process_id$ $nocmdpowershell$ | stats count by host, New_Process_Name | table host, New_Process_Name,count | sort count| rename count as Count $interval.earliest$ $interval.latest$ 1 20nonecellfalsefalsefalsetrue `event_sources` (EventCode=4688) AND (ComputerName="*") AND * Account_Name != "*$$*" (Creator_Process_ID="*") (New_Process_ID="*") New_Process_Name = "*" | head 100 | table _time, host,Account_Name, New_Process_Name,Process_Command_Line, New_Process_ID, Creator_Process_ID -24h@h now 1 20nonecellfalsefalsefalsetrue