← Endpoint Process-Tree Analysis: From Alert to BehaviorSkip to lesson ↓

2. Judge Behavior in Context

Baseline Parent-Child Relationships Without Freezing the Environment

Measure execution by device role, user role, software, version, and time so rare does not become synonymous with malicious.

Approx. 3 min reading · Includes diagrams; allow extra time for reflection and linked resources.

Start reading ↓
About this learning content and editorial review
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

Your focus

What you’ll learn

  • Select a relevant peer group for process behavior.
  • Distinguish rarity, novelty, policy violation, and malicious effect.

Explains peer groups, prevalence, first-seen context, deployment change, seasonality, lineage depth, and expiring exceptions.

Define the peer group before calculating rarity

A process relationship that is normal on a developer workstation may be exceptional on a point-of-sale device. Define peer groups using operating-system version, device role, installed software, business function, management tooling, user role, and location. Measure image path, signer, parent-child pair, command template, user, integrity, time of day, frequency, and downstream behavior. Keep the baseline period and coverage explicit.

Rarity has several meanings. A never-before-seen hash can be a routine software update. A rare parent-child pair can be a first use of an approved feature. A common signed binary can participate in harmful execution. Compare the chain with its own host history and appropriate peers, then consult deployment and change records. First-seen time in the telemetry is limited by retention and sensor coverage; it is not the binary’s creation or publication time. Prefer robust command templates that mask volatile identifiers while retaining security-relevant switches and destinations.

Process frequency only makes sense within a peer groupDevice role, user role, software, version, and time separate routine deployment from meaningful deviation.FIELD GUIDEProcess frequency only makes sense within a peer groupDECISION CUEKioskAdmin workstationKioskOfficeworkstationDeveloper deviceServerAdminworkstationFREQUENCY PLOT
Process frequency only makes sense within a peer group — Device role, user role, software, version, and time separate routine deployment from meaningful deviation.

Use baselines as context, not permission

A baseline describes observed history, not acceptable policy. Long-lived attacker persistence can become common, and a widely deployed misconfiguration remains risky. Combine prevalence with allowlisted business purpose, software inventory, owner, signature validation, path, and behavior. Keep exceptions narrow: exact management tool, expected parent, approved command pattern, device group, owner, and expiry. A signer-only exception is too broad because trusted binaries can execute untrusted content.

Track changes in telemetry itself. Sensor upgrades, new command-line auditing, path normalization, and added devices can produce apparent novelty. Compare counts of reporting hosts and missing fields. When tuning, preserve high-impact deviations such as unsigned execution from user-writable paths, office or browser children launching interpreters, unexpected system-context processes, and rare outbound connections. Close a benign case with the evidence that explained it, then decide whether the behavior belongs in a documented baseline, a time-bound suppression, or no suppression at all.

Rarity and maliciousness occupy different dimensionsCommon harmful behavior, rare benign updates, routine expected tools, and rare high-risk chains require different decisions.FIELD GUIDERarity and maliciousness occupy different dimensionsDECISION CUERare butexplainedCommon but harmfulIMPACTCONFIDENCE / FREQUENCYRare but explainedRare and harmfulCommon and expectedCommon but harmfulBEHAVIOR MATRIX
Rarity and maliciousness occupy different dimensions — Common harmful behavior, rare benign updates, routine expected tools, and rare high-risk chains require different decisions.

Resources