John, SOC analyst wants to monitor the attempt of process creation activities from any of their Windows endpoints. Which of following Splunk query…

Question breakdown

Tests

Splunk queries for Windows Security event IDs

Difficulty

Easy

Key idea: Windows Security Event ID 4688 records the creation of a new process, so it is the event to query when monitoring process creation.

How to reach the answer

1. The clue is 'process creation' on Windows endpoints.
2. Windows Security event 4688 means 'A new process has been created'.
3. The other IDs are either different events or not valid Security log process events.
4. The filter NOT Account_Name=*$ excludes machine accounts, which reduces noise.

Each option

• AIncorrect. 4678 is not the process creation event.
• BCorrect. EventCode 4688 is the Windows Security event for new process creation.
• CIncorrect. 3688 is not a Windows Security process creation event ID.
• DIncorrect. 5688 is not the process creation event.

Common trap: The distractors share the same '688' suffix, so candidates who only half-remember the ID can pick the wrong prefix.

In practice: SOC analysts hunt for suspicious executions, such as encoded PowerShell, using 4688 with command-line auditing enabled, or Sysmon Event ID 1.

Remember: 4688 = process created; 4689 = process exited.

Drafted with AI assistance and checked against the answer key.