Baseline Parent-Child Relationships Without Freezing the Environment
Measure execution by device role, user role, software, version, and time so rare does not become synonymous with malicious.
In this lesson, you will learn to:
- Select a relevant peer group for process behavior.
- Distinguish rarity, novelty, policy violation, and malicious effect.
Baseline Parent-Child Relationships Without Freezing the Environment
Explains peer groups, prevalence, first-seen context, deployment change, seasonality, lineage depth, and expiring exceptions.
Define the peer group before calculating rarity
A process relationship that is normal on a developer workstation may be exceptional on a point-of-sale device. Define peer groups using operating-system version, device role, installed software, business function, management tooling, user role, and location. Measure image path, signer, parent-child pair, command template, user, integrity, time of day, frequency, and downstream behavior. Keep the baseline period and coverage explicit.
Rarity has several meanings. A never-before-seen hash can be a routine software update. A rare parent-child pair can be a first use of an approved feature. A common signed binary can participate in harmful execution. Compare the chain with its own host history and appropriate peers, then consult deployment and change records. First-seen time in the telemetry is limited by retention and sensor coverage; it is not the binary’s creation or publication time. Prefer robust command templates that mask volatile identifiers while retaining security-relevant switches and destinations.
Use baselines as context, not permission
A baseline describes observed history, not acceptable policy. Long-lived attacker persistence can become common, and a widely deployed misconfiguration remains risky. Combine prevalence with allowlisted business purpose, software inventory, owner, signature validation, path, and behavior. Keep exceptions narrow: exact management tool, expected parent, approved command pattern, device group, owner, and expiry. A signer-only exception is too broad because trusted binaries can execute untrusted content.
Track changes in telemetry itself. Sensor upgrades, new command-line auditing, path normalization, and added devices can produce apparent novelty. Compare counts of reporting hosts and missing fields. When tuning, preserve high-impact deviations such as unsigned execution from user-writable paths, office or browser children launching interpreters, unexpected system-context processes, and rare outbound connections. Close a benign case with the evidence that explained it, then decide whether the behavior belongs in a documented baseline, a time-bound suppression, or no suppression at all.
Resources
- Microsoft Audit Process Creation guidance — Use the audit-policy guidance to understand event volume, investigative value, deployment choices, and the conditions required to record process starts.