Process & Account Activity

What is it?

4688 records process creation (with the command line when auditing is on). 4720 is account creation; 4728/4732 add a member to a global/local group (e.g. Domain Admins). These trace what ran and who gained access.

Why it matters

Post-compromise, attackers create accounts and add themselves to privileged groups. A 4720 followed by a 4732 into Administrators is account-based persistence you can catch in the log.

Where you see it

4688 with a NewProcessName and CommandLine; 4720 with the new Sam account; 4732 naming the group and the member added.

What normal looks like

Expected admin tools running, new accounts created through the proper process during onboarding, group changes tied to a ticket.

What suspicious looks like

A new local admin account no one requested, a user added to Domain Admins off-ticket, or 4688 showing a suspicious command line (encoded PowerShell).

How analysts investigate

Correlate account creation (4720) with group additions (4728/4732) and the acting user; read 4688 command lines for encoded/suspicious execution and tie it to the logon session.

Common beginner mistakes

Missing that a 4720 + 4732 pair is self-service persistence into a privileged group.
Ignoring the 4688 command line where the malicious intent is usually visible.

New accounts, new power

  4720  02:20  new account 'svc-helper' created by j.rai
  4732  02:20  'svc-helper' ADDED TO group Administrators by j.rai
  4688  02:21  cmd: powershell -enc SQBFAFgA...  (svc-helper session)
  → create account → make it admin → run encoded PS = persistence chain

4720 + 4728/4732 + 4688 chain together into account-based persistence and privileged execution.

Quick check

A 4720 (account created) is immediately followed by a 4732 adding it to Administrators. Read?

A quick self-check — it doesn't affect your XP or progress.