1 Sysmon log · Process Creation medium severity very-high volume

Sysmon Event ID 1 — Process creation

New process created. Includes full command line, hashes (MD5/SHA256/IMPHASH), parent process, current directory, and integrity level. Far richer than Security 4688.

Why event 1 matters

The backbone of Sysmon-based detection. ParentImage+Image combinations reveal malicious spawns. CommandLine reveals LOLBin abuse, encoded PowerShell, and tool signatures. Hashes enable threat intel lookups. IntegrityLevel shows privilege context. Tools: nearly every attacker tool generates Sysmon Event 1.

How to detect it

Alert: Office apps spawning cmd/PowerShell/wscript/mshta. Alert: PowerShell with -enc or -nop -w hidden. Alert: processes from %TEMP%, %APPDATA%, or user profile. Alert: unusual ParentImage for system processes (e.g., svchost.exe spawning cmd.exe with CommandLine outside normal patterns). Use hash lookups against VirusTotal or threat intel feeds.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageParentCommandLineHashesUser

MITRE ATT&CK mapping

Tactic Technique
Execution Command and Scripting Interpreter (T1059)
Defense Evasion System Binary Proxy Execution (T1218)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious Process Creation via Office Application
status: stable
description: Office app spawning command interpreter (Sysmon)
author: theadminstack.com
date: 2026/05/16
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\winword.exe'
            - '\\excel.exe'
            - '\\powerpnt.exe'
            - '\\outlook.exe'
    selection_child:
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\wscript.exe'
            - '\\cscript.exe'
            - '\\mshta.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate macros
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.initial_access
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 1   // Process creation
// EventData holds: Image, CommandLine, ParentImage, ParentCommandLine, Hashes, User
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Process creation — add EventData fields: Image, CommandLine, ParentImage, ParentCommandLine`
Hunt event 1 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Frequently asked questions

What is Sysmon Event ID 1?

Process creation. New process created. Includes full command line, hashes (MD5/SHA256/IMPHASH), parent process, current directory, and integrity level. Far richer than Security 4688.

Which log records event 1?

Event 1 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 1?

Event 1 is associated with: Command and Scripting Interpreter (T1059), System Binary Proxy Execution (T1218).

How do you detect activity around event 1?

Alert: Office apps spawning cmd/PowerShell/wscript/mshta. Alert: PowerShell with -enc or -nop -w hidden. Alert: processes from %TEMP%, %APPDATA%, or user profile. Alert: unusual ParentImage for system processes (e.g., svchost.exe spawning cmd.exe with CommandLine outside normal patterns). Use hash lookups against VirusTotal or threat intel feeds.