← 03 — Blog

4688 and Sysmon event 1 are not the same event

Tooling2 min read

Both record a process starting, so it is tempting to treat them as interchangeable and join them when you have both. The first join usually fails on the most basic field: the process ID. The two events describe the same process in different formats and with different context, and the differences decide which one a detection should use.

Symptom

A query that matches a Security 4688 to the Sysmon event 1 for the same process returns nothing, even on a machine that logs both. Picking one process by hand shows why: 4688 has NewProcessId: 0x1a2c, Sysmon has ProcessId: 6700.

Cause

0x1a2c is 6700. The Security log writes process IDs in hexadecimal, Sysmon in decimal. Convert before joining — and even then, a PID alone is a weak key: Windows reuses process IDs, so on a busy server the same number belongs to different processes within minutes. Sysmon solves this with ProcessGuid, which is unique per process and repeated in every later Sysmon event about it (network connections, file writes, process access). 4688 has nothing equivalent.

What else differs

Field 4688 Sysmon 1
Process ID hexadecimal (NewProcessId) decimal (ProcessId) plus ProcessGuid
Command line only with Include command line in process creation events enabled always
Parent ParentProcessName (path only) ParentImage and ParentCommandLine
File hash none Hashes, algorithms set in the Sysmon config
Original file name none OriginalFileName from the PE header
Token TokenElevationType, MandatoryLabel IntegrityLevel, LogonId
Working directory none CurrentDirectory
What enables it audit policy, built into Windows a separately installed driver and config

Two rows matter more than the rest for detection:

  • ParentCommandLine. “cmd.exe started by wmiprvse.exe” is a lead; seeing the parent’s own command line often settles it. 4688 gives you only the parent’s path.
  • OriginalFileName. An attacker who copies rundll32.exe to C:\Users\Public\update.exe defeats every rule that matches the image name. The PE header still says RUNDLL32.EXE, and Sysmon records it. 4688 only sees the new name.

Fix

Decide per detection which event it needs, and write that into the rule’s spec — the format in Write the detection spec before the rule has a field for it.

  • Rules about parent–child relationships, renamed binaries or known-bad hashes need Sysmon 1.
  • Rules that must work on every machine, including ones where Sysmon is not deployed yet, should use 4688 — with the command line on, which this two-minute check verifies.
  • If you join the two, convert NewProcessId from hex and add a tight time window and the host name to the key, or join on the Sysmon side using ProcessGuid instead.

Keeping both is not wasted volume: 4688 is the fallback when someone stops Sysmon, which is exactly when you want process logging most. Sysmon without drowning covers a baseline that keeps event 1 affordable.

Takeaway

Same moment, different evidence. Treat 4688 as the always-on minimum and Sysmon 1 as the event you investigate with, and never join them on a raw PID.