Concept Analysis: Process Lineage (Parent-Child Relationships)

Note

Executive Summary: Process lineage (or process tree analysis) is the hierarchical relationship connecting a “parent” process that initiates an execution to a “child” process that is created. In modern Digital Forensics and Incident Response (DFIR), analyzing this relationship is exponentially more powerful than analyzing the binary itself. It enables analysts to distinguish legitimate administrative activity from malicious intrusions based purely on the context of execution, making it the cornerstone of behavioral threat hunting and EDR triage.

1. The Core Philosophy: Context Over Identity

Traditional antivirus solutions focus on what is executing (relying on file hashes, signatures, and static heuristics). Advanced threat actors easily bypass these defenses by utilizing Living Off The Land Binaries and Scripts (LOLBAS)—native, signed Microsoft tools like powershell.exe, certutil.exe, or cmd.exe.

Process lineage analysis shifts the paradigm. Instead of asking “Is this binary malicious?”, DFIR analysts ask: “Who is the parent of this binary, and is this relationship logical?”

Legitimate programs follow predictable execution paths. When an adversary establishes a foothold, they inevitably break these logical rules, leaving a glaring behavioral signature.

2. Normal vs. Abnormal Lineage

To identify malicious activity, analysts must first establish a baseline of normal operating system behavior.

The Expected Baseline (Benign)

When a standard user interacts with the Windows graphical interface to open the command prompt, the lineage reflects human interaction with the OS shell: explorer.exe → cmd.exe

Similarly, background services follow strict hierarchies: services.exe → svchost.exe

The Malicious Signature (Abnormal)

Consider a classic initial access vector: A user receives a weaponized Word document via email, opens it, and enables macros. The macro silently downloads and executes a reverse shell.

The resulting process tree exposes the attack instantly as a single, continuous execution chain:

explorer.exe (User's desktop shell)
└── outlook.exe (User opens email client)
    └── winword.exe (Word opens the attached document)
        └── powershell.exe (🚨 RED FLAG: Malicious macro executes a script)
            └── cmd.exe (🚨 RED FLAG: Script spawns a command shell)
                └── whoami.exe (Attacker runs a recon command)

The DFIR Analysis: whoami.exe, cmd.exe, powershell.exe, and winword.exe are all 100% legitimate, digitally signed Microsoft binaries. However, a word processor has absolutely no legitimate business reason to spawn PowerShell or a command interpreter. This abnormal parent-child relationship is definitive proof of code execution via a macro or software vulnerability.

3. Defeating Process Masquerading

Adversaries frequently rename their malware payloads to blend in with normal system activity (e.g., renaming a backdoor to svchost.exe).

Process lineage analysis defeats this evasion technique instantly. A legitimate svchost.exe is exclusively spawned by services.exe. If an analyst observes an executable named svchost.exe being spawned by winword.exe, chrome.exe, or explorer.exe, it is guaranteed to be malware, regardless of its name.

4. Telemetry and Investigation Sources

To reconstruct a process tree historically, organizations require highly granular endpoint telemetry.

Windows Event ID 4688

The native Windows Security log for Process Creation. It contains the New Process ID and the Creator Process ID (the parent). By chaining these PIDs together chronologically, analysts can manually reconstruct the entire execution tree. Note: Command-line auditing must be enabled via GPO for this to be effective.

Sysmon Event ID 1

Sysmon significantly improves upon native logging by introducing the ProcessGuid and ParentProcessGuid. These globally unique identifiers allow for flawless process tree reconstruction across reboots and PID recycling.

Endpoint Detection and Response (EDR)

Modern EDR solutions automatically ingest this telemetry and graphically map the process tree. This visualization is the core component of the EDR Alert Triage Playbook, enabling analysts to understand the entire attack chain in seconds.

5. Detection & Threat Hunting

Deploy the following behavioral rules to proactively hunt for anomalous process lineage in your environment.

KQL (Defender XDR)

hunt_office_spawning_shells.kql

// Detects Microsoft Office applications spawning command interpreters or script engines
DeviceProcessEvents
// Define the suspicious parent processes
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "msaccess.exe", "mspub.exe")
// Define the suspicious child processes
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, CommandLine
| sort by TimeGenerated desc

Sigma (Suspicious Parents)

sigma_web_server_shell.yaml

title: Suspicious Shell Spawned by Web Server
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: stable
description: Detects web server daemon processes spawning command line shells, indicating a potential web shell execution or RCE exploitation.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\w3wp.exe'        # IIS
            - '\httpd.exe'       # Apache
            - '\nginx.exe'
            - '\tomcat.exe'
            - '\php-cgi.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\whoami.exe'
    condition: selection
level: critical
tags:
    - attack.execution
    - attack.persistence
    - attack.t1505.003

6. Conclusion

Mastering process lineage analysis is what elevates a security professional from relying on static signatures to conducting true behavioral threat hunting. By constantly asking “Who is your parent?”, analysts can uncover the most sophisticated intrusions, rendering traditional evasion techniques obsolete.

---

References & Further Reading

• SANS Institute: Advanced Incident Response and Threat Hunting
• LOLBAS Project: Living Off The Land Binaries and Scripts
• Related Artifact: Event ID 4688 & Process Lineage
• Related Action: EDR Alert Triage Playbook