Windows Event ID 4111 – Microsoft-Windows-Kernel-Process: Process Creation Auditing Event

Start by examining the specific Event ID 4111 entries to understand what processes are being created and their context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. In the Actions pane, click Filter Current Log
4. Enter 4111 in the Event IDs field and click OK
5. Double-click on recent Event ID 4111 entries to examine details
6. Review the General tab for process name, PID, and parent process information
7. Check the Details tab for complete XML data including command line arguments
8. Note the timestamp, user account, and logon session details

Look for unusual process names, suspicious command line arguments, or processes running under unexpected user accounts. Pay attention to processes spawned by common attack vectors like Office applications, browsers, or email clients.

Use PowerShell to programmatically analyze Event ID 4111 patterns and extract specific information for investigation.

1. Open PowerShell as Administrator
2. Query recent Event ID 4111 entries:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4111} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific time range:

$StartTime = (Get-Date).AddHours(-24)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4111; StartTime=$StartTime}
$Events | Format-Table TimeCreated, Id, Message -Wrap

4. Extract process creation details:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4111} -MaxEvents 100
foreach ($Event in $Events) {
    $XML = [xml]$Event.ToXml()
    $ProcessName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
    $PID = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'
    Write-Output "Time: $($Event.TimeCreated) | Process: $ProcessName | PID: $PID"
}

5. Export results for further analysis:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4111} -MaxEvents 1000 | Export-Csv -Path "C:\Temp\ProcessCreation_4111.csv" -NoTypeInformation

Ensure proper audit policy configuration to capture Event ID 4111 consistently and adjust logging levels as needed.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Detailed Tracking
4. Double-click Audit Process Creation
5. Check Configure the following audit events
6. Select both Success and Failure checkboxes
7. Click OK and close Group Policy Editor
8. Update Group Policy by running:

gpupdate /force

9. Verify the audit policy is active:

auditpol /get /category:"Detailed Tracking"

10. For command line auditing, also enable:

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

Investigate suspicious process creation patterns by analyzing parent-child relationships and process execution chains.

1. Create a PowerShell script to map process relationships:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4111} -MaxEvents 500
$ProcessTree = @{}

foreach ($Event in $Events) {
    $XML = [xml]$Event.ToXml()
    $ProcessName = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessName'}).'#text'
    $ProcessId = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessId'}).'#text'
    $ParentProcessName = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ParentProcessName'}).'#text'
    $ParentProcessId = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
    
    $ProcessTree[$ProcessId] = @{
        'ProcessName' = $ProcessName
        'ParentProcessId' = $ParentProcessId
        'ParentProcessName' = $ParentProcessName
        'TimeCreated' = $Event.TimeCreated
    }
}

$ProcessTree | ConvertTo-Json -Depth 3

2. Identify suspicious process chains:

# Look for Office applications spawning unusual processes
$SuspiciousChains = $ProcessTree.GetEnumerator() | Where-Object {
    $_.Value.ParentProcessName -match "(winword|excel|powerpnt|outlook)" -and
    $_.Value.ProcessName -match "(powershell|cmd|wscript|cscript|rundll32)"
}

$SuspiciousChains | Format-Table -AutoSize

3. Monitor for living-off-the-land techniques:

# Detect potential LOLBins usage
$LOLBins = @('certutil', 'bitsadmin', 'regsvr32', 'mshta', 'rundll32', 'installutil')
$SuspiciousLOL = $ProcessTree.GetEnumerator() | Where-Object {
    $LOLBins -contains ($_.Value.ProcessName -replace '.*\\', '' -replace '\.exe$', '')
}

$SuspiciousLOL | Select-Object @{N='PID';E={$_.Key}}, @{N='Process';E={$_.Value.ProcessName}}, @{N='Parent';E={$_.Value.ParentProcessName}}, @{N='Time';E={$_.Value.TimeCreated}}

Set up automated monitoring to detect suspicious Event ID 4111 patterns in real-time for proactive security response.

1. Create a scheduled task for continuous monitoring:

# Create monitoring script
$MonitorScript = @'
$LastCheck = (Get-Date).AddMinutes(-5)
$SuspiciousEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4111; StartTime=$LastCheck} | Where-Object {
    $_.Message -match "(powershell.*-enc|cmd.*\/c.*del|wscript.*\.vbs|cscript.*\.js)"
}

if ($SuspiciousEvents) {
    $AlertMessage = "Suspicious process creation detected: $($SuspiciousEvents.Count) events"
    Write-EventLog -LogName Application -Source "SecurityMonitor" -EventId 9001 -EntryType Warning -Message $AlertMessage
    # Send email or SIEM alert here
}
'@

$MonitorScript | Out-File -FilePath "C:\Scripts\Monitor4111.ps1" -Encoding UTF8

2. Register the monitoring script as a scheduled task:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\Monitor4111.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries

Register-ScheduledTask -TaskName "Monitor-Event4111" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

3. Configure Windows Event Forwarding for centralized collection:

# On collector server
wecutil cs subscription.xml

# Create subscription.xml with Event ID 4111 filter
$SubscriptionXML = @'
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>ProcessCreation4111</SubscriptionId>
    <Description>Collect Event ID 4111 from domain computers</Description>
    <Query>
        <Select Path="Security">*[System[EventID=4111]]</Select>
    </Query>
</Subscription>
'@

4. Set up custom Windows Performance Toolkit (WPT) tracing for advanced analysis:

# Create custom ETW session for process creation
logman create trace ProcessCreationTrace -p Microsoft-Windows-Kernel-Process -o C:\Logs\ProcessTrace.etl -ets

# Stop tracing after collection period
logman stop ProcessCreationTrace -ets