Event ID 4689 — A process has exited.

Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Audit Policy: Detailed Tracking → Process Termination
Collection Priority: Recommended (Palantir, others)
Opcode: Info

Description

A process has exited.

Message #

A process has exited.

Subject:
	Security ID: %1
	Account Name: %2
	Account Domain: %3
	Logon ID: %4

Process Information:
	Process ID: %6
	Process Name: %7
	Exit Status: %5

Fields #

Name	Description
`SubjectUserSid` SID	[Subject] Security ID.
`SubjectUserName` UnicodeString	[Subject] Account Name.
`SubjectDomainName` UnicodeString	[Subject] Account Domain.
`SubjectLogonId` HexInt64	[Subject] Logon ID.
`Status` HexInt32	[Process Information] Exit Status. NTSTATUS reference
`ProcessId` Pointer	[Process Information] Process ID.
`ProcessName` UnicodeString	[Process Information] Process Name.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4689,
    "version": 0,
    "level": 0,
    "task": 13313,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2023-11-06T02:04:26.563982+00:00",
    "event_record_id": 315178,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 20768
    },
    "channel": "Security",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-18",
    "SubjectUserName": "WINDEV2310EVAL$",
    "SubjectDomainName": "WORKGROUP",
    "SubjectLogonId": "0x3e7",
    "Status": "0x0",
    "ProcessId": "0x3f24",
    "ProcessName": "C:\\Windows\\System32\\svchost.exe"
  },
  "message": ""
}

Detection Patterns #

Normalized Process Events

Security-Auditing Event ID 4688: A new process has been created.OREvent ID 4689: A process has exited.ORSysmon Event ID 1: Process creationOREvent ID 5: Process terminated

7 rules

Kusto Query Language

SUNBURST suspicious SolarWinds child processes (Normalized Process Events) (source)

Yuval Naor

Base64 encoded Windows process command-lines (Normalized Process Events) (source)

Yuval Naor

Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events) (source)

Yuval Naor

Show 4 more (7 total)

Potential re-named sdelete usage (ASIM Version) (source)

Microsoft Security Research

Malware in the recycle bin (Normalized Process Events) (source)

Yuval Naor

Probable AdFind Recon Tool Usage (Normalized Process Events) (source)

Yuval Naor

Sdelete deployed via GPO and run recursively (ASIM Version) (source)

Microsoft Security Research

Normalized Process Events

Security-Auditing Event ID 4688: A new process has been created.ANDEvent ID 4689: A process has exited.ANDSysmon Event ID 1: Process creationANDEvent ID 5: Process terminated

3 rules

Kusto Query Language

SUNBURST suspicious SolarWinds child processes (Normalized Process Events) (source)

Yuval Naor

Base64 encoded Windows process command-lines (Normalized Process Events) (source)

Yuval Naor

New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) (source)

Microsoft Security Community

Asim Version

Security-Auditing Event ID 4688: A new process has been created.→Event ID 4689: A process has exited.→Sysmon Event ID 1: Process creation→Event ID 5: Process terminated

3 rules

Kusto Query Language

Dev-0228 File Path Hashes November 2021 (ASIM Version) (source)

Microsoft Security Research

Potential re-named sdelete usage (ASIM Version) (source)

Microsoft Security Research

Sdelete deployed via GPO and run recursively (ASIM Version) (source)

Microsoft Security Research

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4689
Microsoft Learn Audit Policy https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-termination
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4689
Example event sourced from https://github.com/NextronSystems/evtx-baseline