Windows Security Log Event ID 592

592: A new process has been created

On this page

• Description of this event
• Field level details
• Examples

This event allows you to monitor each program as it is executed. Image File Name identify) the executable. Prior to w2k, image file name did not include the path - just the file name itself.

New Process ID: allows you to link this event to other events such as object accesses. To determine when the program ended look for a subsequent event 593 with the same Process ID.

Creator Process ID:identifies the processes that started this process. Look for a preceding event 592 with a New Process ID that matches this Creator Process process ID.

Username and domain identify the user who started the process.

Logon ID can be used to find related object accessand other events that have the same Logon ID including the event 528 and 540 logon events.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 592

• New Process ID:
• Image File Name:
• Creator Process ID:
• User Name:
• Domain:
• Logon ID:

Supercharger Enterprise

 

Mini-Seminars Covering Event ID 592 Top 9 Ways to Detect Insider Abuse with the Security Log 11 Ways to Detect System Intrusions with the Security Log Insider Gone Bad: Tracking Their Steps and Building Your Case with the Security Log Real Methods for Detecting True Advanced Persistent Threats Using Logs Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs Java Insecurity: How to Deal with the Constant Vulnerabilities

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy