Windows Event ID 4688 — A new process has been created

title: Office Application Spawning Suspicious Child Process
status: stable
description: Office app spawning command interpreter — phishing/macro indicator
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
    definition: Requires command-line audit policy enabled
detection:
    selection_parent:
        EventID: 4688
        ParentProcessName|endswith:
            - '\\winword.exe'
            - '\\excel.exe'
            - '\\powerpnt.exe'
            - '\\outlook.exe'
    selection_child:
        NewProcessName|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\wscript.exe'
            - '\\cscript.exe'
            - '\\mshta.exe'
            - '\\wmic.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate macros and add-ins
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.initial_access

SecurityEvent
| where EventID == 4688   // A new process has been created
| project TimeGenerated, Computer, NewProcessName, CommandLine, ParentProcessName, SubjectUserName, TokenElevationType
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4688
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A new process has been created — add EventData fields: NewProcessName, CommandLine, ParentProcessName, SubjectUserName`