Process creation in detail

4688 tells you what executed

Counting logons tells you someone got in; process creation (Event ID 4688) tells you what they did. Pull the process records and read the command lines:

awk -F, '$2==4688 {print $6" => "$7}' /srv/soc-data/windows/security.log

In the terminal

student@vulntech:~$ awk -F, '$2==4688 {print $6" => "$7}' /srv/soc-data/windows/security.log
C:\\Windows\\System32\\cmd.exe => cmd.exe /c whoami
C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe => powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBldA==

A cmd.exe /c whoami is reconnaissance; a powershell.exe launched with -w hidden -enc is an attacker hiding a payload. That second one is worth decoding.

Tip: -enc (or -EncodedCommand) takes base64 of a UTF-16LE string. Attackers use it to dodge keyword-matching; it decodes trivially, which is why you should always do it.