Glossary: Threat Vectors: Files, Networks and Endpoints

Windows event IDs (4688, 4104)

Also written: event 4688, event 4104, 4688, 4104, process creation log, command-line logging

Windows log events used to catch living-off-the-land activity: 4688 'A new process has been created' records each new program (and its full command line when command-line logging is on), and 4104 records each PowerShell script block that runs.