Event ID 4689Audit SuccessSecurity
Windows Event ID 4689 — Process Exited
Logged when a process terminates. Paired with 4688 it gives the full lifetime of a process.
Why It Matters
Short-lived processes that execute and immediately exit are common for one-shot attack tools (droppers, reconnaissance commands). The exit status code can also reveal crashes or unexpected terminations.
Key Fields
Process NameThe executable that exited
Exit Status0 = clean exit; non-zero may indicate a crash or error
Process IDLinks back to the 4688 event for this process
Investigation Tips
- 1.Very short-lived processes (milliseconds between 4688 and 4689) executing cmd.exe with base64 arguments are suspicious.
Go deeper: the full Suspicious Process Creation — Abnormal Parent-Child Relationships guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Suspicious Process Creation — Abnormal Parent-Child Relationships guide →See Event ID 4689 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →