← Endpoint Process-Tree Analysis: From Alert to Behavior
1. Reconstruct Execution Correctly
Build a Trustworthy Process Lineage Parse Command Lines as Structured Evidence
2. Judge Behavior in Context
Baseline Parent-Child Relationships Without Freezing the Environment Analyze Signed System Binaries by Behavior
3. Correlate Impact and Close the Case
Fuse Process, File, Network, Registry, and Identity Evidence Disposition, Containment, and Detection Handoff
1. Reconstruct Execution Correctly

Build a Trustworthy Process Lineage

Use process creation records to connect parents and children while respecting host, time, provider, and identifier limits.

In this lesson, you will learn to:

  • Reconstruct a process chain from 4688 or Sysmon process-creation data.
  • Explain how PID reuse, missing telemetry, and provider differences limit lineage claims.

Build a Trustworthy Process Lineage

Introduces event 4688, Sysmon event 1, process IDs, Process GUIDs, image paths, users, hashes, parent data, and the difference between observed lineage and causation.

Start from the creation event, not the alert drawing

Windows Security event 4688 is generated when process-creation auditing records a new process. Depending on event version and policy, it can include the new process ID and image, creator or parent process information, subject and target user fields, token elevation, integrity label, and command line. Sysmon event 1 can add a Process GUID, Parent Process GUID, hashes, file metadata, user, integrity level, and full command context. The sources overlap but are not identical, so record provider, channel, schema version, and original fields.

Anchor on the alerted process and locate its creation record. Walk upward using parent identifiers and downward using child references on the same host and time range. A numeric PID is reused after a process exits; joining only on PID across a long window can attach the wrong parent. Sysmon Process GUIDs are designed to support more durable correlation across a domain, but collection gaps and provider restarts still require time and host checks. Preserve image path and original filename separately: two files can share a basename, and the same program can exist in several locations.

Process lineage connects creation records, not just namesParent identifiers, process identifiers, time, host, image path, and provider form a defensible execution chain.FIELD GUIDEProcess lineage connects creation records, not just namesUser shellor serviceParentcreationrecordAlertedprocessChildbehaviorEndpointeffectWORKFLOWUser shell or serviceEndpoint effectPROCESS LINEAGE
Process lineage connects creation records, not just names — Parent identifiers, process identifiers, time, host, image path, and provider form a defensible execution chain.

Treat lineage as observed structure, then test causation

A parent field records the process identified as creator in the telemetry; it does not automatically prove the human intent, document origin, or full causal chain. Some execution mechanisms, brokers, services, scheduled tasks, and management tools insert an intermediary. Telemetry may begin after the parent started, a sensor may filter an event, and adversarial tampering can degrade fields. Mark an unknown parent as a gap instead of attaching the nearest process by time.

Build a minimal lineage table with UTC time, host, process and parent identifiers, image paths, command lines, user, logon or session identifier, integrity, hash, signature, and source record. Then add the earliest process whose context is understood: user shell, service manager, scheduled-task engine, browser, office application, remote-management agent, or unknown. State “event X records A as parent of B” before claiming “A caused B to perform action C.” Causation strengthens when command arguments, file creation, network connections, and user activity agree.

Identifier strength changes across the evidence layersBasename, path, PID, GUID, hash, user, host, and time contribute different scopes and collision risks.FIELD GUIDEIdentifier strength changes across the evidence layersName and pathPID within host and timeProcess GUIDHash, user, session, and sourceEVIDENCE LAYERS
Identifier strength changes across the evidence layers — Basename, path, PID, GUID, hash, user, host, and time contribute different scopes and collision risks.

Resources

  • Microsoft Sysmon events reference — Use the current event catalog and Process Create field descriptions to interpret process, parent, hash, user, and correlation evidence.
Next: Parse Command Lines as Structured Evidence →