How to search Windows Security Event Logs for MS Office child/grandchild process names?

[johnmccash]

Hi,

I'd like to be able to write a search to identify processes that are children or grandchildren of MS Office application processes, and which start up within 60 seconds of that application being launched. Windows Security Event log 4688 process start events contain the computer name, process ID, and new process ID, so it ought to be possible to extract this information, but I'm not sure how to write a search that properly connects parent processes with their children. I suppose you could do it with 'map', but that would involve a separate search for every office process that starts up (a couple of hundred per minute, across my enterprise network).

Any thoughts on the appropriate way to do this?

Thanks
John

[sundareshr]

Try this pseudo code

base search | stats list(newprocessid) as npid list(_time) as t by creatorprocessid | eval z=mvzip(npid, t) | rex field=z "^(?<npid>[^,]+),(?<t>.*)" | streamstats window=1 current=f latest(t) as nextpid by Creator_Process_ID | eval diff=t-nextpid | table * diff | where diff<60 | fieldformat t=strftime(t, "%x %X")