Windows · xml
Windows Security 4688 — Process creation
A new process was created, with fields that depend on the event version and audit policy.
Log sources tagged execution. Browse source profiles associated with execution.
Windows · xml
A new process was created, with fields that depend on the event version and audit policy.
PowerShell · xml
PowerShell logs pipeline execution details for configured modules.
PowerShell · xml
PowerShell logs script-block text with an identifier and multipart sequence fields.