Get started
Course catalog
CourseIncident ResponseFree

Advanced Event Log Analysis

Process creation events are a type of Windows event that, if enabled, will be recorded in the local Windows Event Viewer as Event ID 4688 whenever a new process is started. They include information such as time, process

Start this course
Intermediate
Lessons
6
Lesson questions
0
Labs
0
Exam questions
—
Duration
0.5h
XP
1000

About this course

Process creation events are a type of Windows event that, if enabled, will be recorded in the local Windows Event Viewer as Event ID 4688 whenever a new process is started. They include information such as time, process name, parent process, command line (optional but preferred), and so on.

Table of contents

1 sections · 6 lessons

  1. 1Lessons6 lessons
    1. 1.1Process CreationPreview
    2. 1.2DNS Activity
    3. 1.3File Folder Monitoring
    4. 1.4BITS Client Event Log
    5. 1.5Network Connections Event Log
    6. 1.6MSI Event Logs
Advanced Event Log Analysis | VulterX Academy