Process terminated. ProcessName and ExitCode are key.
Short-lived processes created then immediately terminated may indicate payload execution. Use 4688+4689 pairs to compute process lifetime.
No standalone alerting. Calculate process lifetimes for forensic timelines. Filter for processes identified as malicious via 4688.
ProcessNameSubjectUserNameStatus Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4689 // A process has exited
| project TimeGenerated, Computer, ProcessName, SubjectUserName, Status
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4689
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A process has exited — add EventData fields: ProcessName, SubjectUserName, Status`A process has exited. Process terminated. ProcessName and ExitCode are key.
Event 4689 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Detailed Tracking' subcategory (Success and/or Failure).
No standalone alerting. Calculate process lifetimes for forensic timelines. Filter for processes identified as malicious via 4688.