Process relationships
Normal patterns
These are the lineages that should not surprise you. On Windows:
explorer.exe → winword.exeUser-launched document activity.
services.exe → svchost.exeNormal Windows service initiation.
svchost.exe (Schedule) → <scheduled binary>Scheduled task execution: on modern Windows, tasks spawn from svchost.exe running the Schedule service, sometimes via taskhostw.exe. (taskeng.exe was retired in 2015; seeing it on a current build is itself a masquerading red flag.)
And on macOS, where the Alert chapter’s own Case B lives:
launchd → <almost everything>launchd is PID 1: macOS’s init process, service manager, and scheduler in one. Daemons, agents, and user-launched apps all ultimately descend from it, so “parent is launchd” carries far less signal than “parent is services.exe” does on Windows.
Cursor → Cursor Helper (Plugin)Electron and browser apps spawn their helpers (Renderer, GPU, Plugin, Utility) as direct children of the main app process, never of each other. A “helper” whose parent is not its own main app is the macOS lineage anomaly worth your attention.
Terminal.app → zsh → <tool>Interactive shell work descends from a terminal. The suspicious mirror image is a GUI app with no business shelling out (a PDF viewer, a chat client) spawning bash or osascript.
Reading a macOS tree: signatures and notarization
Case B in the Alert worked example hands you this tree. Here is how to parse it:
launchd (PID 1) Apple platform binary
└─ Cursor Developer ID: Anysphere, notarized
├─ Cursor Helper Developer ID: Anysphere, notarized
└─ Cursor Helper (Plugin) Developer ID: Anysphere, notarizedOn macOS the tree gives you two extra parse targets that Windows lineage does not: the code-signing chain and notarization status. Together with the install path, they are the exculpatory (or damning) evidence.
Signing identity
Apple’s own platform binaries (launchd, the system daemons) are signed by Apple’s Software Signing certificate. Third-party software is signed with a Developer ID certificate that names the vendor. The parse question is not “is it signed” but “who signed it, and does that match what the binary claims to be.” Ad-hoc or missing signatures inside a tree of properly signed processes are the standout.
Notarization
Notarization is Apple’s automated malware scan for third-party software distributed outside the App Store; Gatekeeper checks the ticket at first launch. Apple’s own OS binaries are not notarized (they do not need to be), so “launchd is not notarized” is expected, while “this vendor app is not notarized” is a real flag on a managed fleet.
Install path
A signed binary running from /Applications where the MDM (mobile device management) system installed it is baseline. The same binary name running out of ~/Library, /tmp, or a mounted DMG is staging. Signature says who built it; path says who put it there.
Where does this telemetry come from? EDR agents on macOS consume the Endpoint Security framework for process and signing events; the formats and normalization page covers the per-platform sources. The tells transfer directly: a hollowed-svchost equivalent does not exist on macOS, but “helper with the wrong parent,” “signed binary in the wrong path,” and “unsigned process in a signed tree” are the same lineage-plus-trust reasoning this page teaches for Windows.
What to flag
Suspicious lineage signals
- Unexpected origins.
notepad.exespawningwmic.exe. Notepad should not be spawning anything. - Compressed timing. Multiple processes launching within sub-second intervals suggests scripted automation. Installers and build systems produce the same burst legitimately, so weigh the parent process and the host’s role before reading the burst as hostile.
- Office spawning shells.
winword.exe → cmd.exe → powershell.exeis the classic macro-execution chain. - System binaries in User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. contexts. Elevated processes running with anomalous parent-child relationships.
A direct spawn of msdt.exe by winword.exe strongly suggests exploitation of Follina CVE-2022-30190. A vulnerability in the Microsoft Support Diagnostic Tool that allowed a malicious Office document to trigger remote code execution via a crafted URL handler. , where a malicious document triggers the Microsoft Support Diagnostic Tool to run attacker-controlled code.
Common malicious chains
Five chains an analyst should recognize on sight. Each one has a characteristic shape, a typical purpose, and a recognizable telltale that distinguishes it from look-alike legitimate activity.
Rogue script execution
PowerShell downloads a script from a remote location and runs it directly from a public temp directory. In this row the labeled arrows are actions (download, execute-from), not parent-child spawns; the boxes are a process, an artifact, and a location. The shape is recognizable because legitimate PowerShell almost never sources its code from %TEMP% or %PUBLIC%. The telltale is code executing out of a user-writable directory.
Registry manipulation for persistence
A shell spawns a trusted binary (reg.exe here; wmic and PowerShell offer parallel routes) to write a registry value that survives reboot. The spawn itself is ordinary; the destination key is what gives it away. Watch for writes to autorun keys, Run/RunOnce hives, or service definitions.
Unauthorized service creation
sc.exe create registers a new Windows service that auto-starts on boot. Legitimate software installs services this way at install time; adversaries do it post-compromise to survive reboots. Watch for service creation outside an installer process or from an unusual user context.
Process hollowing
A legitimate process (svchost.exe is a favorite) is created suspended, its executable memory is replaced with attacker code, and it resumes under the original name and digital signature. The tree looks normal at a glance, but lineage still betrays it: real svchost.exe is spawned by services.exe, so an svchost whose parent is anything else deserves immediate scrutiny. Memory and behavioral telemetry are how the code swap itself is caught; signature checks will not.
Token theft and impersonation
A new process is launched under another user’s security context using a stolen authentication Token A Windows credential object that represents an authenticated user session. Tokens let processes run with the rights of the user who started them. Stealing one lets a process behave as that user without ever needing their password. . The activity looks like the impersonated user. Detection depends on cross-correlating the process owner against where the user was actually logged in.
Reconstructing a macro-borne intrusion
An EDR alert reports anomalous child processes spawned by Microsoft Word on a finance team workstation.
Process tree investigation reveals:
winword.exe (PID 3421)
└─ cmd.exe (PID 3422)
└─ powershell.exe (PID 3423)
└─ outbound TLS connection to a recently registered domainThe chain alone is enough to recognize the pattern: macro Execution The attacker successfully runs malicious code on a system, typically using interpreters, scripts, payloads, or legitimate tools. from a document, shell launch, scripted download cradle, command-and-control establishment. The exact IP is not the point. The shape of the chain is.
What an analyst checks next
- The originating email and attachment in the user’s mailbox.
- Other recipients of the same email (lateral exposure).
- The PowerShell A command-line shell and scripting language built on the .NET framework, commonly used for system administration and potentially for malicious purposes. Command Line In SOC analysis, the argument string a process was launched with. Often the load-bearing forensic field on an EDR alert because it reveals what the process was actually told to do. for download cradle patterns.
- DNS queries from the host in the relevant window.
- File system creates in
%TEMP%and%APPDATA%correlated to the PowerShell PID. - Whether the user opened the document themselves or it executed on preview.
Visualization tools
Process tree visualization makes anomalies obvious. Three categories of tooling matter:
Sysinternals Process Explorer
Detailed local tree analysis and thread inspection. Good for ad-hoc investigation on a single host.
System Informer (formerly Process Hacker)
Lightweight alternative for in-depth lineage mapping and thread inspection. Open source; the project was renamed System Informer in 2022 and continues active development.
EDR consoles
CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR all provide real-time tree visualization with historical playback at scale.
Evasion to know about
Adversaries who understand process tree analysis design their tradecraft to look normal in the tree. The four techniques below are the most common evasions an analyst will encounter in real intrusions. Recognizing them by name accelerates the moment of “wait, that is not what it looks like.”
DLL search order hijacking
A DLL Dynamic Link Library. A shared library that Windows loads into a process at runtime to provide functions the process uses. Programs name the DLLs they need; Windows finds them by searching a defined order of directories. is loaded by a legitimate binary from one of several search paths in a defined order. An adversary places a malicious DLL earlier in that order than the real one. The legitimate, signed binary loads the malicious DLL instead of the real one, executing attacker code under the trust of the original program.
The telltale: a process tree that looks normal at the binary level, but with a DLL that was loaded from an unusual location (a writable directory, the user profile, a removable drive). EDRs that track DLL loads can flag this. Tree views that only show processes cannot.
Fileless execution
fileless An execution model that runs the malicious payload entirely from memory, without ever writing it to disk. Common techniques include PowerShell loading code via reflection, WMI event subscriptions whose consumers execute script payloads (the MOF defining them is compiled into the WMI repository at persistence time), and .NET assemblies loaded straight into memory. attacks run their payload from memory, never landing on disk. Disk-based detections (file hashes, AV scans, file integrity monitoring) see nothing. The process tree shows only legitimate parents (often PowerShell or WMI).
The telltale: a long-running PowerShell or WMI process with a command line that decodes a base64 blob and executes it, or a WMI event subscription that fires at boot. Memory analysis and command-line decoding catch this; surface process inspection does not.
Alternate data streams (ADS)
NTFS supports multiple data streams per file. The default stream is what most tools and users see. An alternate data stream A secondary data stream attached to an NTFS file. The primary stream is what you see in Explorer. The alternate stream is invisible to most tools but can be opened and executed directly. Used historically to hide payloads inside otherwise innocuous files. can hide a payload inside a normal-looking file, and the malicious code can be invoked directly from the stream.
The telltale: a process whose image path includes a colon (C:\Users\victim\readme.txt:hidden.exe). The format file:stream is the giveaway. Most modern EDRs flag ADS execution, but the technique is still seen in older or under-instrumented environments.
LOLBin-only chains
The adversary uses only trusted system binaries ( LOLBins Living Off the Land Binaries: trusted, signed system executables (certutil, rundll32, mshta) weaponized so the malicious part is the argument line, not the file on disk. The evasion face of the Living Off The Land technique covered under Execution. such as certutil, regsvr32, mshta, rundll32) to download, decode, and execute attacker code. No malicious file is ever written to disk by the adversary, and no signature on any of the binaries is wrong.
The telltale: common system binaries being invoked with command-line flags they almost never use in legitimate operations (certutil -urlcache -split -f, regsvr32 /s /u /n /i:http://…). Command-line parsing is what catches this; the process names alone look harmless.
Key Takeaway
Process relationship analysis bridges single-alert detection and full kill-chain reconstruction. Combined with command-line Parsing Breaking a raw alert, log line, or command string into its component fields so each can be examined on its own: the user, the host, the action, the time. In triage, parsing the alert is the first move; the details that decide a verdict live in the fields, not in the alert name. , it is the foundation for confidently mapping what an adversary did and what they are trying to do next.
Next up
Network correlation
Tie host activity to outbound traffic. C2 detection through timing, TLS, DNS, and exfiltration indicators.
Read network correlation