Tools · Forensics tools · 22 / 25
Sysmon: Event ID 1, a process being created
Event ID 1 records a new process: image path, command line, user, hashes, and the parent. Read the parent and the path together. A stock binary can still be the process that copied the file.
The fields that carry the story
A process-create event includes UtcTime, ProcessGuid, ProcessId, Image, CommandLine, CurrentDirectory, User, LogonId, IntegrityLevel, Hashes, and the parent’s GUID, pid, image, and command line. Image is the path of the executable. CommandLine is the text used to start it, when the system recorded it. User is the account. Hashes are of the file on disk at the time, with the algorithms the config asked for. You compare a SHA-256 in the event to the SHA-256 Autopsy computed for the same path.
OriginalFileName, Description, and Company come from the file’s version resource. They are useful when Image is a strange path and the version resource still says the original name of a known tool. A mismatch between Image and OriginalFileName is a lead: the file’s internal name and the path disagree. It is a lead you verify against the hash, because resources can be ordinary and paths can be ordinary. Write both fields if you cite the mismatch.
The parent is part of the event
ParentImage and ParentCommandLine are on the same row as the child. You do not have to find the parent’s Event ID 1 to know what Sysmon thought the parent was, though you should find it when it is in the export so you have the parent’s own GUID and user. explorer.exe as the parent of powershell.exe fits an interactive desktop. A parent in a Temp directory, or a parent whose hash you cannot find on disk, is the row you tag. The child can be a stock, NSRL-matching powershell.exe in both cases. The hash says the bytes are familiar. The parent and the command line say how they were used.
IntegrityLevel and the logon help when the same user name has more than one session. A process at High is a different kind of token from a process at Medium. You record the level you were given and you do not translate it into “the attacker elevated” without a separate event that shows a change. For this case, Medium under NORTHLINE\avery is the interactive user, and that matches the profile Autopsy parsed.
Event ID 1
UtcTime: 2026-04-15 13:17:04.221
ProcessGuid: {1b2c-4812}
User: NORTHLINE\avery
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: powershell.exe -EncodedCommand Q29weS1JdGVtIC1Q...
ParentImage: C:\Windows\explorer.exe
Hashes: SHA256 matches the Autopsy value for this pathThe command line is evidence you already decoded
Quote the command line or point at the extract. If it contains an encoded argument, the CyberChef recipe is the decode, and the event remains the source. In the sample above, the encoded field is the copy command from the earlier lesson, shortened in the display. You do not need a second copy of the whole blob in every paragraph. You need the event time, the ProcessGuid, and a pointer to the decoded output that names both workbook paths.
CurrentDirectory matters when the command uses a relative path. A relative p4.xlsx plus a current directory of the user’s Temp is a full path. A relative name plus an unexpected directory is a different file. If the field is empty, say it is empty and stick to the paths that are absolute in the decoded command.
Event ID 5 tells you the process ended
Event ID 5 is process termination for a ProcessGuid. Paired with Event ID 1, you get a lifetime. The memory snapshot at 09:22 Brooklyn showed this powershell already exited, and psscan had an exit at 09:19:58 Brooklyn. An Event ID 5 at 13:19:58 UTC for the same ProcessGuid is that same instant. You write the agreement across tools. If Event ID 5 is missing, the config may not have included termination, or the export was cut. Check the config note before you call the process still running.
The hash on Event ID 1 is the file at create time. If Autopsy’s hash of powershell.exe matches, the binary on disk at imaging matches the binary Sysmon hashed. A mismatch means the file changed, or you are looking at a different path. That comparison is the join between the log and the disk, and it belongs in the report in one sentence.
Worked case: explorer starts a stock shell at 09:17 Brooklyn
You find one Event ID 1 whose Image is powershell.exe and whose UtcTime is 13:17:04, which is 09:17:04 America/New_York. The parent is explorer.exe. The user is NORTHLINE\avery. The SHA-256 matches the NSRL-matching binary in Autopsy. The command line’s encoded argument decodes to the copy from Documents\Payroll-April.xlsx to the Temp path. ProcessGuid {1b2c-4812} is the identifier you will carry into file and network events.
Event ID 5 for that GUID is 13:19:58 UTC, 09:19:58 Brooklyn, the same instant psscan recorded. You note the agreement. You do not treat the stock hash as a reason to drop the event. The command line is the reason it stays.
Diagram
From an Event ID 1 row to a process you can join
- Who
Read User, IntegrityLevel, and the logon. Tie them to the profile Autopsy already parsed.
- What
Read Image, OriginalFileName, and the hash. Compare the hash to the disk exhibit.
- How
Read CommandLine and CurrentDirectory. Decode encoded arguments with the saved recipe.
- Parent
Read ParentImage and the GUIDs. Find Event ID 5 if you need the end of the lifetime.
ProcessGuid {1b2c-4812} 09:17:04–09:19:58 America/New_York Parent: explorer.exe Hash: matches the on-disk powershell.exe
Check yourself
1. Event ID 1 shows powershell.exe with a SHA-256 that matches NSRL, parent explorer.exe, and a command line that decodes to a copy of the payroll workbook into Temp. What is the sound reading?