1

There is some process or application which starts up at random time, days could pass by, till it pops up. It appears only in the taskbar has an icon which looks like a sun and quickly disappears. I suspect it to be something fishy and want to figure out what it could be.

So far I tried increasing the logging level from windows log management, but did not found anything unusual.

Do you have any suggestions how to hunt that thing down?

I'm running on windows 10.

Ninius86
  • 113

1 Answers1

1

Option 1

For a quick and easy review you can use ExecutedProgramList . Although it's easy to use, it's are not as detailed as the second option (see below) e.g. it won't give you a complete list of programs that have been executed. Alternatively you could use ProcessMonitor.

Option 2

If you want to be more thorough you can use Process Tracking Events

If you haven't done so already you need to enable Process Tracking Events in the Windows Security Event Log to start future logging (so you'll have to wait until the pop up comes up the next time).

How to enable Audit Process Creation

  1. Run gpedit.msc

  2. Select "Windows Settings" > "Security Settings" > "Local Policies" > "Audit Policy"

    enter image description here

  3. Right click "Audit process tracking" and select "Properties"

  4. Check "Success" and click "OK"

    enter image description here

How to use Audit Process Creation

Once the Process Tracking Events are enabled you can use all process creations and deletions (and failed attempts at same) will appear in the Security log.

To view them, run Event Viewer. In the navigation pane expand the "Windows Logs" sub-tree and click "Security". All the security events will be displayed.

Alternatively the following Powershell commands to examine the events:

Process Start:

Get-EventLog Security | Where-Object {$_.EventID -eq 4688} | Format-List

Process Stop:

Get-EventLog Security | Where-Object {$_.EventID -eq 4689} | Format-List

Thanks to DavidPostill you'll find a much more detailed answer here on superuser.

Albin
  • 10,559
  • Found it using Option 2, at the end it happened to be Logitec LogiOptions, probably nothing harmful, but now I know and can sleep – Ninius86 Oct 19 '19 at 09:29
  • @Ninius86 glad I could help, thanks for the upvote! – Albin Oct 19 '19 at 09:32
  • "Audit Process Creation" location is shown incorrectly in the above post. The post shows the location of "Audit process tracking" instead. "Audit Process Creation" is actually here: Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking > Audit Process Creation – Roland Pihlakas Sep 07 '23 at 12:47
  • @RolandPihlakas maybe incorrectly now, back then there was no "Advanced Audit Policy Configuration" as you can see in the screenshot there was no "Advanced Audit Policy Configuration". Thank you for the addition. – Albin Sep 07 '23 at 21:47