// REFERENCE
4689 — A process has exited
Log: Security
Low risk
A process exited. Paired with 4688 by Process ID it lets you measure a process's lifetime; very short, repeated processes can betray malicious automation.
Related tools
Work with this in:
Related
4672
4672 — Special privileges assigned to new logon 4673
4673 — Sensitive privilege use 4688
4688 — A new process was created
4672 — Special privileges assigned to new logon 4673
4673 — Sensitive privilege use 4688
4688 — A new process was created
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.