> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/observe-process-creation.md).

# Observe Process Creation

## Objective

Generate a simple process on `CLIENT01` and find the related Sysmon Process Create event.

Sysmon records process creation as Event ID `1`.

## Generate a Simple Process

On `CLIENT01`:

1. Open **Command Prompt**.
2. Run:

```
notepad.exe
```

3. Leave Notepad open for a moment.
4. Close Notepad.

## Find the Event

Open the Sysmon Operational log and filter for:

```
1
```

Look for an event where the image ends with:

```
\notepad.exe
```

## Review the Important Fields

Record the following fields if they are present:

* UtcTime
* ProcessGuid
* ProcessId
* Image
* CommandLine
* User
* ParentProcessGuid
* ParentProcessId
* ParentImage
* Hashes

Because Notepad was launched from Command Prompt, the parent process should normally relate to `cmd.exe`.

## What Happened

The activity is simple:

1. `cmd.exe` was already running.
2. You entered `notepad.exe`.
3. Windows created a new Notepad process.
4. Sysmon recorded the new process.
5. The event preserved information about both the new process and its parent.

## Investigation Questions

Use the event to answer:

1. Which process started?
2. Which user started it?
3. What command line was used?
4. Which parent process launched it?
5. At what time did it happen?

## Security Relevance

A process name alone rarely tells the full story. The command line, user, parent process, path, and timing can make the same executable look normal or suspicious.

For example, `notepad.exe` started manually by a user is usually routine. The same process launched unexpectedly by an unusual parent may deserve more investigation.

## Verification

The lab is complete when you can find the Notepad Process Create event and explain the relationship between `cmd.exe` and `notepad.exe`.